Patent Application
20160259583
This application is based upon and claims the benefit of priority from the prior Japanese Patent Application No. 2014-116716, filed on Jun. 5, 2014 and the prior Japanese Patent Application No. 2014-231349, filed on Nov. 14, 2014, the entire contents of which are incorporated herein by reference.
The present invention relates to a storage device, a storage device system, and an information terminal, specifically to a storage device and a storage device system each including a nonvolatile memory and improving security so that recovery of a file erased from an application is difficult, and also an information terminal using the same.
Conventionally, files generated by a personal computer or the like are mainly stored on a USB memory or the like using a NAND flash memory. However, a USB memory or the like may be possibly lost. In the case where a file stored thereon includes sensitive information such as private information or the like or business secrets which need to be kept confidential strictly, a serious business loss may be incurred if such a USB memory is lost. In order to avoid such a loss, files are manually erased based on certain criteria, or software including an algorithm for erasing files at a certain timing is implemented on a personal computer.
A USB memory or the like using a NAND flash memory uses a file system by which a storage area is divided into a data area and a file management area. For erasing a file, the file management area is flagged so that it is merely considered that the corresponding file is “erased”. “Deletion” of a file is also referred to as “erasure”, but “erasure” of a file does not necessarily signify erasure of a nonvolatile memory having data of a file written therein. Formatting a medium such as a USB memory or the like merely indicates that the management area is erased and a start address of the file in the data area cannot be specified, which makes it difficult to read the file. The data itself of the file remains in the data area. Therefore, the data of the deleted file may occasionally be recovered by use of an application such as data recovery software or the like.
In order to erase the file so as not to be unrecoverable, fixed data such as FF or 00 needs to be written to the entire data area. Deletion software for this purpose is known. However, when using such an application, the user needs to start the application and perform a deletion operation in accordance with the procedure of the application. This makes it difficult to eliminate a human error.
The present invention has an object of providing a storage device (Safe Erase File Memory: SEM) and a storage device system each capable of making recovery of erased data difficult so that the data is erased safely, and an information terminal using the same.
A storage device system in an embodiment according to the present invention includes a driver controlling an interface between a nonvolatile memory and an external host; and a controller located between the nonvolatile memory and a control unit, the controller detecting a logical address of an old data area for a deleted or overwritten file. The controller writes invalid data to the logical address of the old data area for the deleted or overwritten file.
An information terminal in an embodiment according to the present invention includes a storage device in an embodiment according to the present invention.
The present invention provides a storage device and a storage device system each capable of making recovery of erased data difficult so that the data is erased safely, and an information terminal using the same.
and
Hereinafter, a storage device according to the present invention will be described. The storage device according to the present invention may be carried out in various different embodiments, and are not to construed as being limited to the following embodiments. In the drawings referred to in the embodiments, the identical parts or the parts having substantially the same functions will bear the same reference signs, and repetition of the same descriptions will be omitted.
Regarding the present invention, each of operations is assumed to be performed on a logical address usable for a storage device unless otherwise specified. In this specification, the expression that a file is “deleted” given with no other specific explanation indicates the following state: as described above, the data area in which data of a file is written is not changed, and a corresponding management area is changed to represent information indicating that the data is deleted. The expression that a file is “overwritten” indicates the following state: data is stored on the same logical address on the file system; or a new data area is assigned and updated file data is stored on the new data area, and an area where old data was stored is released from an assigned state but the data remains at the logical address. The “old data” refers to the entirety of, or a part of, data that has been deleted or overwritten with another data. In the case where data is overwritten with another data at one, same logical address, the capacity (size) of the old data and the capacity (size) of the overwriting data (new data) are not necessarily the same with each other, and the old data may possibly remain. By contrast, in the case where the expression that “data is overwritten in a specific area” or that “data is overwritten in a data area” is provided, the term “overwritten” indicates that data is newly written to the target logical area, such that when data is read from the target logical address, the read data is the newly written data and the data written before the newly written data cannot be read. Namely, the term “overwritten” indicates that all the old data is overwritten with new data and the old data cannot be read at all.
A storage device and a storage device system according to the present invention include a controller that controls a nonvolatile memory (such a controller will be referred to as an “SEM controller”). As the storage device, a typical auxiliary storage device such as, for example, a micro SD card, a hard disc drive (HDD) or the like is used. It should be noted that the storage device may be any device having a function of controlling a nonvolatile memory. For example, a storage device including a detachable nonvolatile memory is encompassed in the “storage device” according to the present invention.
In the present invention, the term “storage device system” represents a concept encompassing the above-described storage device. Namely, the term “storage device” system encompasses a case where a storage device includes an SEM controller, a case where a storage device and an external host both have the function of an SEM controller in a dispersed manner, and a case where an external host includes an SEM controller. Therefore, an embodiment of the storage device system according to the present invention may be directed to a storage device itself, specific functional blocks of a storage device and an external host, or a specific functional block of an external host that controls a nonvolatile memory connected with the external host.
The SEM controller has a function of controlling an interface between the storage device and the external host outer to the storage device, and controls the nonvolatile memory in accordance with a command given from the interface.
Namely, the storage device is connected with the external host via the SEM controller. A basic operation of the storage device is to store, read or delete data by a file system of the external host. In addition, the storage device receives a command issued to be used by the SEM controller itself, and stores or reads data.
The external host includes a driver that controls storage, read or deletion of data by use of the file system via the interface. Namely, the file system included in the external host controls the nonvolatile memory via the driver, the interface and the SEM controller.
The SEM controller may provide a correspondence between a logical address of the file data to be controlled by the above-described file system and a physical address in the nonvolatile memory, and may control storage or read of the data on the nonvolatile memory.
For writing data, the SEM controller receives data from the interface and writes the data to the nonvolatile memory. For reading data, the SEM controller may read data from the nonvolatile memory and transmit the data to the interface.
The SEM controller may be included in the nonvolatile memory, or may be separate from the nonvolatile memory and included in the storage device. Alternatively, the SEM controller may not be located in the storage device but may be located in the external host. In the case of being located in the external host, the SEM controller may be located in the external host as an independent component or may be provided as one function of a CPU in the external host. The SEM controller may include a CPU, a ROM and a RAM, or may include a random logic or an FPGA.
Hereinafter, a storage device and a storage device system in embodiments according to the present invention will be described with reference to the drawings. In the following example, the above-described SEM controller is divided into a first controller as a functional block that controls a nonvolatile memory and a second controller as a functional block that performs control between the storage device and the external host outer to the storage device, for the sake of easy understanding. The control operation of the SEM controller is the same as that in the case where the SEM controller is formed of one body. Needless to say, the SEM controller may be formed of one body.
A storage device 100 includes a first storage device 30 and a second controller 40. The first storage device 30 includes a nonvolatile memory 10 and a first controller 20 that controls the nonvolatile memory 10. The first controller 20 includes an interface IF3 with the nonvolatile memory 10. As the first storage device 30, a typical auxiliary storage device such as, for example, a micro SD card, a hard disc drive (HDD) or the like is used.
The second controller 40 includes an interface IF1 with an external host 1000 and an interface IF2 with the first storage device 30. The second controller 40 issues a command to the interface IF2 in accordance with a command given from the interface IF1. For writing data, the second controller 40 receives data from the interface IF1 and transmits the data to the interface IF2. For reading data, the second controller 40 receives data from the interface IF2 and transmits the data to the interface IF1. The second controller 40 may include a CPU, a ROM and a RAM, or may include a random logic or an FPGA.
The first storage device 30 is connected with the external host 1000 via the second controller 40. A basic operation of the first storage device 30 is to store, read or delete data by a file system of the external host 1000. In addition, the first storage device 30 receives a command issued to be used by the second controller 40 itself, and stores or reads data.
As seen from the external host 1000, the above-described operation of the storage device may be considered as being the external host 1000 controlling the nonvolatile memory 10 via a driver 1020 located in the external host 1000, the interface IF1, the second controller 40 and the first controller 20.
In the example described with reference to
The controller 41 includes the interface IF1 with the external host 1000 and the interface IF3 with the nonvolatile memory 10. The controller 41 is an integral body including a functional block 40′ corresponding to the second controller 40 shown in
The operations of the interface IF1, the interface IF2 (not shown), the interface IF3 and the nonvolatile memory 10 are substantially the same as those described with reference to
As shown in
In this embodiment also, the operations of the second controller 40, the interface IF1, the interface IF2, the first controller 20, the interface IF3 and the nonvolatile memory 10 are substantially the same as those described with reference to
In the example described with reference to
The file system of the external host 1000 transmits command 1, command 2, command 3, . . . to the storage device 100 via the driver 1020 and the interface IF1. The second controller 40 in the storage device 100 receives command 1, command 2, command 3, . . . , and transmits command 1′, command 2′, command 3′, . . . to the first storage device 30 via the interface IF2. Command 1′, command 2′, command 3′, . . . respectively correspond to command 1, command 2, command 3, . . . received by the second controller 40 and have been converted from command 1, command 2, command 3, . . . so as to be interpretable by the first storage device 30.
The second controller 40 transmits, to the first storage device 30, command 1′, command 2′, command 3′, . . . corresponding to command 1, command 2, command 3, . . . received from the external host 1000, and also transmits command A, command B, command C, . . . issued to be used by the second controller 40 itself to the first storage device 30. On this point, the second controller 40 is different from a chip or the like that merely performs interface conversion. Command A, command B, command C, . . . may be issued together with command 1′, command 2′, command 3′, . . . . Alternatively, command A, command B, command C, . . . may be issued after command 1′, command 2′, command 3′, . . . are transmitted, and after the second controller 40 is put into a state of not receiving any command such as command 1, command 2, command 3, . . . or the like from the external host 1000, namely, after the interface IF1 is put into an idle state. The contents of the commands issued to be used by the second controller 40 itself will be described below.
In embodiment 1 according to the present invention, the second controller 40 includes backup of management information on the first storage device 30. The “management information” is, for example, information that is stored in a root directory area, a sub directory area, a FAT area, a BPB (BIOS Parameter Block) area or the like of, for example, a FAT (File Allocation Table) file system. The management information on the first storage device 30 is managed by the first controller. The second controller 40 receives, from the external host 1000 via the interface IF1, a command to execute file deletion, and transmits a corresponding command to the first storage device 30, and thus file deletion is performed. When this occurs, the management information on the first storage device 30 is rewritten. In this state, a difference occurs between the management information on the first storage device 30 and the backup included in the second controller 40. Therefore, the second controller 40 detects an old data area for the deleted file and specifies an area where the data of the file as a target of deletion is stored. The area specified in this manner is an area managed by a logical address.
The second controller 40 transmits, to the first storage device, a command to write invalid data to the specified area. The invalid data to be written may be data of the same value such as 0x00, 0xFF or the like, or randomly generated data. Namely, the “invalid data” refers to, for example, meaningless data irrelevant to the data written in the specified area before the invalid data is written. After writing the invalid data to the specified area, the second controller 40 updates the backup, so that the backup and the management information on the first storage device 30 match each other.
Hereinafter, with reference to
First, commands to be issued and internal processes to be performed in order to allow the second controller 40 to interpret a file system of the first storage device 30 will be described. The second controller 40 issues read 0 to read the contents of BOOT and finds the FAT area and the ROOT area by calculation. Next, the second controller 40 issues read 100 to read the contents of FAT and acquires information on the state of use of the file data. Then, the second controller 40 issues read 200 to read ROOT and acquires information on the file name. When acquiring the information on the state of use of the file data and the information on the file name, the second controller 40 may create backup of such information.
Next, an operation of the second controller 40 of detecting a deleted file will be described. Herein, it is assumed that FILE2 has been deleted.
Now, an operation of the second controller 40 of making the information on the deleted file unrecoverable will be described.
As described above, in embodiment 1, the second controller 40 includes the backup of the management information on the first storage device 30, compares the backup and the management information against each other to detect an old data area for the deleted file, and writes invalid data to the detected old data area. Since the storage device 100 writes the invalid data to the area where the data of the file is actually stored, the user is allowed to delete the data safely by merely performing a normal file deletion operation with no use of any special application in the external host 1000.
In embodiment 2, unlike in embodiment 1, the second controller 40 does not include the backup of the management information on the first storage device 30. The second controller 40 receives a file deletion command from the external host 1000 and issues a command regarding normal file deletion to the first storage device 30. Then, in an idle state where the interface IF1 between the external host 1000 and the storage device 100 is not in operation, the second controller 40 analyzes the file system of the first storage device to specify the deleted file and the area where data of the deleted file is stored. In addition, the second controller 40 writes invalid data to the specified area. The invalid data to be written is substantially the same as that in embodiment 1.
As described above, in embodiment 2, in an idle state where the interface IF1 between the external host 1000 and the storage device 100 is not in operation, the storage device 100 analyzes the file system and writes invalid data. Owing to this, embodiment 2 has an advantage of increasing the speed of access as compared with embodiment 1, in which the file is deleted and the invalid data is written when a command to delete the file is received.
In embodiment 1 and embodiment 2 described above, the second controller 40 analyzes the file system of the first storage device to specify the deleted file and the area where the deleted file is stored. In addition, it is shown that the second controller 40 writes the invalid data to the specified area so that recovery of the erased data is made difficult and the data is erased safely.
In a modification, data originally stored in the specified data may be encrypted and the original data may be overwritten with the encrypted data, instead of invalid data being written in the specified data. In this modification, the second controller 40 includes an encryption block. The second controller 40 encrypts the data originally stored in the specified data and overwrites the original data with the encrypted data in the first storage device 30. The encryption block may support a common key encryption system such as, for example, AES, and may be implemented as hardware or an IP core, or may be implemented as software for the second controller 40.
In such a structure, the key encryption used for decryption needs to be managed strictly in order to comply with the gist of the present invention. In the case where the key encryption is strictly managed and kept secret, the user of the storage device merely acquires undecipherable data even when reading the above-described specified area. In this manner, recovery of the data in the specified area is made difficult. A system may be constructed by which in the case where recovery of the data on the storage device is made absolutely necessary for the reason of an accident, a crime or the like, the manager of the key encryption used for decryption may recover the original data.
The key encryption system may be the same as, or different from, the key encryption system in embodiment 5 described below. In the above example, the second controller 40 includes the encryption block. Alternatively, the encryption block may be included in any other controller, needless to say.
In embodiment 3, the second controller 40 treats the first storage device 30 as a memory including virtual physical addresses. The second controller 40 converts a logical address attached to a read/write command received via the interface IF1 into a physical (virtual) address by use of a logical address-physical address conversion table, and performs read or write from or to the post-conversion area.
In this embodiment, like in embodiment 1, the second controller 40 includes backup of the management information on the first storage device 30. The second controller 40 detects an old data area for the deleted file based on the difference between the management information and the backup, and specifies the area where the data of the file as the target of deletion is stored. In addition, the second controller 40 invalidates the correspondence between the logical address of the specified area and the physical (virtual) address. As a result, even if it is attempted to read data from the logical address, the correspondence of which with the physical (virtual) address is invalidated, the stored data is not reached. In this case, the second controller 40 transmits, to the external host 1000, the invalid data, which is predefined data of the same value such as 0x00, 0xFF or the like, or randomly generated data.
In
As described above, in embodiment 3, the second controller 40 controls the first storage device 30 by use of the logical address-physical address conversion table, and invalidates the correspondence between the logical address of the area of the deleted file and the physical address. When it is commanded to read data from the area, the correspondence of which with the physical address is invalidated, the second controller 40 transmits predetermined invalid data in return. Since data in the old data area for the deleted file is made unreadable, the deleted file is protected against an attempt of analysis performed by use of an application such as data recovery software or the like. The process of the second controller 40 in embodiment 3 is mainly to cut the correspondence between the logical address and the physical address. Therefore, embodiment 3 has an advantage that the process time is shorter as compared with embodiment 1 or embodiment 2 in which invalid data is written. Embodiment 3 also provides an effect that in the case where it is attempted to read data by removing the first storage device 30 from the storage device 100, it is difficult to recover meaningful data because the addresses have been converted.
In embodiment 4, the second controller 40 holds a part of the management information on the first storage device 30 as a look-up table. Upon receiving a read command from the external host 1000, the second controller 40 refers to the look-up table. When the value indicated by the look-up table represents the deleted area, the second controller 40 does not read data from the first storage device 30 and transmits predetermined invalid data to the external host 1000 in return. The contents of the invalid data are substantially the same as those in embodiment 3.
Embodiment 4 may be combined with embodiment 1. In the case where the second controller 40 receives a read command to read data from the old data area for the deleted file while writing invalid data to the old data area, the second controller 40 transmits predetermined invalid data in return.
Embodiment 4 may be combined with embodiment 2. The area to which invalid data is to be written is specified on the stage where the second controller 40 has analyzed the file system. Therefore, based on such information, the look-up table is created. In the case where the second controller 40 receives, while writing invalid data, a command to read data from the area to which the invalid data is being written, the second controller 40 transmits predetermined invalid data in return.
As described above, in the case where embodiment 4 is combined with embodiment 1 or embodiment 2, even while invalid data is still being written, data of the deleted file is not read. The invalid data may be transmitted to the external host 1000 in return after the write of the invalid data is once stopped or while the invalid data is being written. Therefore, the response speed is increased.
Embodiment 5 may be used in combination with any of embodiment 1 through embodiment 4 described above. The encryption makes analysis of the data of the deleted file more difficult.
Hereinafter, implementation forms according to the present invention will be described.
The information terminal 900 may be connected with a display 942, a USB memory 950, a keyboard 960, or a mouse 970.
The information terminal 900 includes a CPU 910 that performs a computation process, a chip set 920 that provides interface with an external device, semiconductor drives 930 and 931 that store programs (operating system, device driver, and application software) and user data, a main memory 935 that temporarily stores the program and the user data described above that may be targets of computation performed by the CPU, and a graphic unit 940 that performs an imaging process.
The CPU 910 includes a memory controller 912 connected with the main memory 935 via a memory bus 936, a graphic bus controller 913 connected with the graphic unit 940 via a graphic bus 941 (e.g., PCI Express 2.0), and a built-in graphic controller 914.
The chip set 920 and the CPU 910 are connected with each other via CPU buses 923 (e.g., DMI 2.0). The chip set 920 includes a display interface 924 that receives data from the built-in graphic controller 914 in the CPU 910 or the graphic unit 940 via the CPU bus 923 and outputs the received data to the display 942 via a display output bus 943. The chip set 920 is also connected with the semiconductor drives 930 and 931 respectively via serial buses 932 and 933 (e.g., SATA 3.0). The USB memory 950, the keyboard 960 and the mouse 970 are connected with the chip set 920 respectively via serial buses 951, 961 and 971 (e.g., USB 3.0).
The semiconductor drive 930 or 931 in the information terminal 900 may be formed of the storage device described with reference to
In the case where, for example, the semiconductor drive 930 in the information terminal 900 is a normal SSD and the semiconductor drive 931 in the information terminal 900 is a storage device according to the present invention, an operating system and a semiconductor drive device driver may be mainly stored on the semiconductor drive 930 whereas user data may be stored on the semiconductor drive 931. The semiconductor drive device driver may write invalid data to the old data area for the deleted file in the semiconductor drive 931. Alternatively, for example, a program that controls the CPU 910 and the chip set 920, so as to detect the old data area for the deleted file and to transmit a read command to read data from the old data area for the deleted file, may be included in the semiconductor drive 930 or the semiconductor drive 931. In this case, the CPU 910 or the chip set 920 to be controlled by the program acts as the above-described controller.
The USB memory 950 may be formed of the storage device shown in
The semiconductor drive 930 may include a USB memory driver, and the USB memory driver may write invalid data to the old data area for the deleted file in the USB memory 950 as described above. Alternatively, a program that controls the CPU 910 and the chip set 920, so as to detect the old data area for the deleted file and to transmit a read command to read data from the old data area for the deleted file, may be included as the above-described controller.
The semiconductor drive 930 may be formed of the storage device shown in
Owing to having the above-described structure, the information terminal 900 in an embodiment according to the present invention safely erases user data which may include sensitive information such as private information or the like or business secrets which need to be kept confidential strictly, so that recovery of the erased data is difficult.
The information terminal 2000 includes a slot into which a SIM card 3100 or a USB memory 3110 each storing communication information is insertable.
The information terminal 2000 includes an application processor 2100 that performs a computation process, a wireless communication unit 2200, a sensor 2300, a display 2400, a power source management unit 2500, an audio unit 2600, a camera module 2700, a first memory 2800 formed of a volatile memory, and a second memory 2900 formed of a nonvolatile memory that stores programs (operating system, drive driver, and application software) and user data.
The wireless communication unit 2200 controls communication between the information terminal 2000 and an external wireless base station, and is connected with the application processor 2100 via a serial bus 2210. The wireless communication unit 2200 is also connected with an antenna 2220.
The sensor 2300 includes a temperature sensor, an acceleration sensor, a position sensor, a gyrosensor or the like. Information detected by such a sensor is supplied to the application processor 2100 via a serial bus 2310 (e.g., I2C).
The display 2400 is a liquid crystal display or an organic EL display each having a touch panel function, and is connected with the application processor 2100 via a display interface unit 2420 and a touch panel interface unit 2410.
The power source management unit 2500 is connected with a lithium ion battery 2510, and controls power supply to all the units in the information terminal 2000 and charge/discharge of the lithium ion battery 2510. The power source management unit 2500 is connected with the application processor 2100 via a serial bus 2520 (e.g., I2C).
The audio unit 2600 is connected with a speaker 2620 and a microphone 2630, and is connected with the application processor 2100 via a serial bus 2610 (e.g., I2C).
The camera module 2700 is connected with a two-dimensional CMOS sensor 2710, and is connected with the application processor 2100 via a serial bus 2720 (e.g., CSI).
The first memory 2800 formed of a volatile memory is connected with the application processor 2100 via a memory bus 2810. The first memory 2800 and the application processor 2100 may be stacked together and put into one package. The first memory 2800 temporarily stores programs (operating system and application software) and user data that may be targets of computation.
The second memory 2900 formed of a nonvolatile memory is connected with the application processor 2100 via a memory bus 2910 (e.g., USB 3.0). The second memory 2900 and the application processor 2100 may be stacked together and put into one package. The second memory 2900 stores programs (operating system and application software) and user data.
The second memory 2900 is formed of the storage device shown in
As described above, the second memory 2900 stores the operating system as well as the semiconductor drive device driver (which may be one element of the operating system) and the user data. The semiconductor drive device driver writes invalid data to the old data area for the deleted file in the second memory 2900. Alternatively, a program that controls the application processor 2100, so as to detect the old data area for the deleted file and to transmit a read command to read data from the old data area for the deleted file, may be included as the above-described controller.
The USB memory 3110 is formed of the storage device shown in
The second memory 2900 may include a USB memory driver, and the USB memory driver may write invalid data to the old data area for the deleted file in the USB memory 950. Alternatively, a program that controls the application processor 2100, so as to detect the old data area for the deleted file and to transmit a read command to read data from the old data area for the deleted file, may be included as the above-described controller.
Owing to having the above-described structure, the information terminal 2000 in an embodiment according to the present invention safely erases user data which may include sensitive information such as private information or the like or business secrets which need to be kept confidential strictly, so that recovery of the erased data is difficult.
The micro SD card 330 corresponds to the first storage device 30 (not shown) according to the present invention, and is attached to the USB memory 300 with the connector 390. The micro SD card 330 may be detachable or fixed.
In
The SEM controller unit 301 may be in a case form, a cover form, a card form or any other form. For example, the SEM controller unit 301 may be in a form of a USB extension cable. In this case, the second controller 340 may be located in the vicinity of either terminal, or may be located in the vicinity of the terminal on the external host side and the terminal on the existing USB memory side in a dispersed manner. The user attaches the SEM controller unit 301 in any of the above-described forms to an existing PC and connects an existing USB memory to the connector 390 of the SEM controller unit 301. In this manner, the user can enjoy the effect that recovery of the deleted data is difficult and the data is safely erased, by use of the existing resources. The SEM controller unit 301 and an existing USB may be integrated together into, for example, a cap form that can be, for example, used, stored and transported. In this case, the existing USB memory may be used as a memory compatible to the SEM controller.
Hereinafter, application examples of the present invention will be described.
As shown in
Referring to
In the case where the first storage device in a storage device in an embodiment according to the present invention is fixed, it is conceivable that a mala fide third party disassembles the storage device to remove the first storage device and analyzes the stored contents. Even in such a case, as long as the conversion between the logical address and the physical address described in embodiment 3 or the encryption process described in embodiment 5 has been performed, the analysis is difficult. In the case where invalid data is written as in embodiment 1 or embodiment 2, recovery of the data of the deleted file may be impossible.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2014-116716 | Jun 2014 | JP | national |
| 2014-231349 | Nov 2014 | JP | national |
