1373713·.·/.·. 第097丨丨6226號專利申請案 中文說明書及圖式替換本（|〇|年8月） 九、發明說明： 【發明所屬之技術領域】 本發明係關於一種記憶系統；更詳細地說，本發明係關於一種安全 且可擴充（scalable )之固態磁碟系統。 【先前技術】 快閃式（flash based )之固癌磁碟（s〇iid state disk ; SSD )已慢慢地 堀起’並自工業、國防以及企業應用端逐漸地被一般使用者消費端所 廣為接受。這股趨勢背後最主要的驅動力即來自於先進的快閃技術發 展以及快閃元件本身的優勢。快閃式之固態磁碟與習知硬碟機（hard diskdrive ; HDD)相較之下，其具有以下之優點： 1_功率耗損較低。 2 -重量較輕。 3. 逸散熱量較低。 4. 無噪音^ 5. 無機械元件。 然而’在逐漸取代硬碟機的同時，固態磁碟也有一些待解決的問題， 如： 1.成本較高。 2·密度較低。 3·系統效能較差。 此外’―般固態磁磲通常只能管理4階、8階、16階、32階或更多 兀件之一快閃記憶體群組，因此在以下方面更具有高難度之設計挑戰： 1.管理眾多快閃裝置介面之輸出接腳（pin__)。 5 第097丨丨6226號^利‘_案 中文說明書及圖式替換本（1〇1年8月） 2.遍及於眾多快閃元件間之均勻抹除（wear leveiing)。 3·固態磁碟系統之可製作性與可測試性。 4. 支持新快閃技術及可從中獲益之時間差距。 5. 上市時間。 6. 自新快閃技術中所可節省之成本。 人習知硬碟機並無内建之安全防護。若—具有—硬碟機之主機系統被 知走後，則其硬碟機之内容將可輕㈣被存取以及盜用。即使可藉由 軟體將整個磁碟進行加密，習知硬碟機在實際應用上仍存在著以下 問題： h因軟體之加密與解密所造成之系統效能犧牲。 2. 必須另外安裝驅動程式以進行加密動作α 3. 若密碼認證魏僅屬於該硬雜，則仍具倾攻擊之危險。 倘若固態磁碟由利基型產品（niche pr〇duct)轉變成較為普遍之使用 者產品而成為主流，則固態磁碟必須針對上述缺點進行改善，且須另 外增加諸如安全性、可擴充性等其它優點。 第1圖係為一習知安全數位（securedigital;SD)快閃卡之方塊圖， 其包含-實體介面11、-安全數位卡控制器12以及快閃記憶體13。 只體；I面11係透過介面匯流排（interface bus) 14連接至—主機系統。 利用-安全數位卡、微型快閃（eQmpaet flash ; CF)卡以及通用争列 匯流排（imiversa丨seriai bus ; USB )驅動器即可組成_簡易型式之固 態磁碟。 於一習知儲存系統中’例如美國專利申請案第10/707,871號（其公 開號為2GG5GG㈣44)、第iG/7()9,718號（其公開號為·5_5〇63)、 1373713 _ 第097丨丨6226號專利申請案 中文說明書及圖式替換本（1〇丨年8月） 美國公告專利第6,098，119號、第6,883,083號、第6,877,044號、第 6,421，760 號、第 6，138，176 號、第 6,134,630 號、第 6,549,981 號以及 美國公開專利第20030120865號所揭露之儲存系統，於系統啟動或運 J 作期間（runtime)，一儲存控制器將自動安裝及配置磁碟驅動器。前 -述之儲存控制器可執行基本之儲存辨識以及彙總功能（aggregation functionality)。習知技術之主要優點即在於運作期間，能夠偵測磁碟 驅動器之插入以及移除。然而習知技術卻無法在系統啟動期間識別主 • 機系統與儲存系統之間存在的非同步特性。由於儲存控制器之功能相 當於一虛擬控制器，因此在主機系統啟動期間，儲存控制器需要花費 時間辨識、職及配魏㈣鶴器。假如沒有使城线與儲存系 統再次同步（re-synchronize)之機制存在，則主機系統僅會停止並且 沒有辦法辨識及安裝虛擬邏輯儲存器H習知系統頂多只能當作 次要儲存系統，而非主要儲存系統。美國公告專利第6,098，119號的另 -個缺點則⑽、統要求各實體驅動隸安裝制需有—❹個預先載 入（preload)之「參數設定（押⑺喊㈣出喂）」。此一缺點將對自動 •安裝造成限制。 大多數之習知线並未針對儲存器之延伸性（啊油瞻y)或可 擴充性（scalability)提供解決之方法。儘管美國專利申請案第 10/707,871 5虎（其公開就^^祕⑼㈣⑷號以及第黯⑽，爪號（其 a開5虎為20050005063)提出了具有擴充性之儲存虛擬電腦系統，其 係著重於心摘接至一貫體主機（可能為—主機電腦或一词服器）之 式/轉虛健繼。·專利絲針對上述虛_存之啟動 問題提出討論。适些專利之虛擬儲存的架構仍僅能作為次要儲存器之 7 1373713 第097丨丨6226號^利案 中文說明書及圖式替換本（丨〇1年8月） 用。 此外，習知系統亦無法解決密碼認證與硬體加密之驅動安全性的問 題。其中硬體加密已然成為筆記型電腦中不可或缺之主要驅動應用產 品。 如第2圖所示，美國專利第7,003,623號係為一種較為簡明之固態 磁碟系統。該固態磁碟系統包含一串列高速硬碟介面（serial advanced technology attachment ’· SATA)至快閃記憶體控制器25以及一組快閃 5己憶體13。該SATA至快閃記憶體控制器25包含一 satA主機介面 251以及複數個快閃裝置介面252。SATA主機介面係用以連接 (interfacing)主機系統20之SATA主機控制器21，同時快閃裝置介 面252係用以連接快閃記憶體13。 各快閃記憶體13具有約略15至23個訊號接腳以連接至控制器25。 SATA主機介面251貝，j需要4個訊號接腳以連接至該sata主機控制 器2卜SATA錄me憶體控㈣25則需要總數至少為124的訊號接 腳來管控8個快閃記憶體13 ;或總數為244的訊號接腳來管控16個 快閃記憶體13。 同樣如第2圖所示，控制器25必須管控錯誤更正碼（議rc咳她 code ; ECC)、均勻抹除、壞區塊重新映射㈤此化代侧卯i⑻、 閒置儲存空間之分配以及眾多内部至快閃記憶體式固態磁碟之作業紀 錄（book keeping tasks)。由此可見，隨著快閃記憶體元件數目之辦加， 控制器的_度也«之上升。如此—來，不僅將對控㈣之縣造 成影響’於習知眺態磁餘统上，更增加了可製造性與可測試性方 面的問題。就本質上而言’ f知技術不具備可擴充之特性，意即相同 1373713 ... 第097 U6226號專利申請案 中文說明書及圖式替換本（1〇丨年8月） 之控制襲無法被賴於二魏〇不同_密度之料。若同一控 制器需使用於二種或更多不同種類密度之設計雜㈣之接腳數量 必/頁至v此合納I24個接腳，以連接四個快閃記憶體；或Μ4個接腳， 乂連接八個決閃Alt體’或甚至484個接腳，以連接十六個快閃記憶 體晶片。因此’習知系統僅能限用於小密度應用之賴磁碟而不具 備完整的可延伸及可擴充之特性。 據此，-種能解決上述問題之系統以及方法係必須的 。而本發明即 可滿足此類需求。 【發明内容】 本發明係揭露-種固態磁碟系統。該系統包含一使用者訊標（蒙 token)以及搞接至_主機系統之第—層安全虛擬儲存控制器。該系 =亦包含複數«二層安全虛擬儲存控制器以及複數個第三層虛擬儲 、中轉第—層安全虛擬儲存控制m有-與該第-層 =儲=器相容之介面，而該等第三層虛擬儲存裝置係辆接 至泫專第一層安全虛擬儲存控制器。 根據本發明之系統與方法可提供下列優點。 L該系統與方法係採用—安全虛擬儲存控制器結構。 2· s亥系統與方法係採用—種基於該安全虛擬儲存控制器結構的可 擴充之固態磁磲系統。 。/、u去仏基於現今普遍並盛行之㈣卡，裝置上所建立之 縣、密度及 4…玄系統與料制虛擬儲存處理祕合密度及㈣效能。 9 1373713 中文說明書溫 5. 該系統與方法可視需求使用較多層之虛擬儲存控制器以擴充密 度及系統效能。 6. 該系統與方法可視需求於該虛擬儲存控制器中使用編碼引擎，以 即時（omfly)處理於上傳串流與下傳串流之間資料交換的 加/解逸作業》其中，該資料交換之進行係於主機與裝置之間。 7. 該系統與方法使用—USB訊標來作為固態磁碟之獨立密碼認 證。 8. 該系統與方法係允許該安全且可擴充之固態磁碟 (secure-and-scalable solid state disk ; SNS-SSD)利用使用者自 開機、休眠至一般使用階段之經驗來取代硬碟機。 根據本發明之系統及方法係適用於一快閃式儲存器、磁碟儲存系 統、可攜式儲存裝置' 企業儲存系統、個人電腦、伺服器、無線儲存 器以及多媒體儲存系統。 【實施方式】 本發明係關於一種記憶體系統。更詳細地說，本發明係關於一種安 全且可擴充之固態磁碟系統。以下之敘述係使熟悉此項技術領域者可 乂利用本發明，同時提供本發明之應用及所需條件。下述之實施例僅 用以例舉本發明之實施態樣，以及闡釋本發明之技術特徵，並非用以 限制本發明之範疇。任何熟悉此技術者可輕易完成之改變或均等性之 安排均屬於本發明所主張之範圍。1373713······. Chinese Patent Specification and Drawing Replacement No. 097丨丨6226 (|〇|August) IX. Invention Description: [Technical Field] The present invention relates to a memory More specifically, the present invention relates to a secure and scalable solid state disk system. [Prior Art] Flash-based s〇iid state disk (SSD) has slowly picked up and has gradually been used by general users in industrial, defense, and enterprise applications. Widely accepted. The main driving force behind this trend is the development of advanced flash technology and the advantages of the flash components themselves. Compared with the conventional hard disk drive (HDD), the flash type solid state disk has the following advantages: 1_ low power consumption. 2 - Lighter weight. 3. The heat dissipation is low. 4. No noise ^ 5. No mechanical components. However, while gradually replacing the hard disk drive, the solid state disk also has some problems to be solved, such as: 1. Higher cost. 2. The density is low. 3. System performance is poor. In addition, '---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Manage the output pins (pin__) of many flash device interfaces. 5 No. 097丨丨6226 ^利'_ Case Chinese Manual and Graphical Replacement (January 1st, August) 2. Wear leveiing throughout many flash components. 3. The manufacturability and testability of the solid state disk system. 4. Support the new flash technology and the time gap that can benefit from it. 5. Time to market. 6. The cost savings from the new flash technology. There is no built-in security protection for people who know the hard disk drive. If the host system with the hard disk drive is known to be removed, the contents of the hard disk drive will be lightly (4) accessed and stolen. Even if the entire disk can be encrypted by software, the conventional hard disk drive still has the following problems in practical applications: h The system performance sacrifice due to encryption and decryption of the software. 2. The driver must be installed separately for the encryption action. α 3. If the password authentication Wei is only the hard one, it is still in danger of attacking. If solid-state disks are mainstreamed by the conversion of niche pr〇ducts to more general user products, solid-state disks must be improved for these shortcomings, and additional additions such as safety, expandability, etc. advantage. 1 is a block diagram of a conventional secure digital (SD) flash card including a physical interface 11, a secure digital card controller 12, and a flash memory 13. The body is connected to the host system through an interface bus 14 . A simple-type solid-state disk can be constructed using a secure digital card, an eQmpaet flash (CF) card, and a universal squad bus (imiversa丨seriai bus; USB) driver. In a conventional storage system, for example, U.S. Patent Application Serial No. 10/707,871 (the disclosure of which is No. 2 GG5 GG (4) 44), iG/7 (9, 718 (the publication number is 5_5〇63), 1373713 _ 097 丨丨6226 Patent Application Chinese Manual and Graphic Replacement (August 1st) US Bulletin Patent Nos. 6,098,119, 6,883,083, 6,877,044, 6,421,760, 6,138,176 The storage system disclosed in No. 6,134,630, No. 6,549,981, and U.S. Patent No. 20030120865, a storage controller will automatically install and configure the disk drive during system startup or runtime. The storage controller described above can perform basic storage identification and aggregation functionality. The main advantage of the prior art is the ability to detect the insertion and removal of the disk drive during operation. However, conventional techniques are unable to identify the non-synchronous characteristics that exist between the host system and the storage system during system startup. Since the function of the storage controller is equivalent to a virtual controller, during the startup of the host system, the storage controller needs time to identify, serve, and match the Wei (4) crane. If there is no mechanism to re-synchronize the city line and the storage system, the host system will only stop and there is no way to identify and install the virtual logic storage. The conventional system can only be regarded as a secondary storage system. Not the main storage system. Another shortcoming of U.S. Patent No. 6,098,119 is (10). It is required that each entity drive the installation system to have a pre-loaded "parameter setting (be (7) shout (four) out). This shortcoming will limit the automatic installation. Most of the familiar lines do not provide a solution to the extensibility of the reservoir or the scalability. Despite the US Patent Application No. 10/707, 871 5 Tiger (which publicly discloses the secrets (9) (4) (4) and 黯 (10), the claw number (which is a 5 tiger is 20050005063) proposes a scalable storage virtual computer system, which focuses on Yu Xin picked up to the main body host (may be - host computer or a word machine) type / turn virtual success. · Patent silk for the above-mentioned virtual_crowding startup problem. Suitable for the virtual storage architecture of patents It can still only be used as a secondary storage device. 7 1373713 No. 097丨丨6226 ^ Chinese case description and schema replacement (丨〇1 August). In addition, the conventional system can not solve the password authentication and hardware. Encryption drives security issues. Among them, hardware encryption has become an indispensable main driver application in notebook computers. As shown in Figure 2, U.S. Patent No. 7,003,623 is a relatively simple solid state disk system. The solid state disk system includes a serial advanced technology attachment '· SATA to the flash memory controller 25 and a set of flash 5 memory. The SATA to flash memory The controller 25 includes a satA host interface 251 and a plurality of flash device interfaces 252. The SATA host interface is used to interfacing the SATA host controller 21 of the host system 20, and the flash device interface 252 is used to connect to the flash. Memory 13. Each flash memory 13 has approximately 15 to 23 signal pins for connection to the controller 25. SATA host interface 251, j requires 4 signal pins to connect to the sata host controller 2 SATA Recording me (4) 25 requires a total of at least 124 signal pins to control 8 flash memory 13; or a total of 244 signal pins to control 16 flash memory 13. Also as shown in Figure 2 It is shown that the controller 25 must control the error correction code (discussion rc cough her code; ECC), even erase, bad block remapping (5) this generation side 卯i (8), allocation of idle storage space, and numerous internal to flash memory The book keeping tasks of solid-state disks. It can be seen that with the increase in the number of flash memory components, the controller's _ degree is also rising. So, it will not only cause the county of the control (four) Influence 'in the customary state On the magnetic system, the problems of manufacturability and testability are increased. In essence, the technology does not have the expandable characteristics, that is, the same 1373713 ... Patent Application No. 097 U6226 The control and the replacement of the schema (August 1st) can not be relied on by the different _ density materials of the second Wei. If the same controller needs to be used in two or more different types of density design (4) The number of pins must be / page to v to accept I24 pins to connect four flash memory; or Μ 4 pins, 乂 connect eight flashing Alt body 'or even 484 pins to connect ten Six flash memory chips. Therefore, the conventional system can only be used for low-density applications without having a complete extendable and expandable feature. Accordingly, systems and methods that solve the above problems are necessary. The present invention satisfies such needs. SUMMARY OF THE INVENTION The present invention is directed to a solid state disk system. The system includes a user token and a layer-layer secure virtual storage controller that interfaces to the _host system. The system also includes a plurality of "two-layer secure virtual storage controllers and a plurality of third-tier virtual storage, transiting layer-layer secure virtual storage control m--compatible with the first-tier=store=, and The third layer of virtual storage devices are connected to the first layer of the secure virtual storage controller. The system and method in accordance with the present invention provide the following advantages. L. The system and method employs a secure virtual storage controller architecture. 2. The shai system and method employs an expandable solid state magnetic enthalpy system based on the secure virtual storage controller architecture. . /, u go to the current and prevailing (four) card, the county, density and 4... the system and the virtual storage processing secret density and (4) performance. 9 1373713 Chinese manual temperature 5. The system and method can use more layers of virtual storage controllers to expand density and system performance. 6. The system and method may use an encoding engine in the virtual storage controller to directly process an add/release operation of data exchange between the upload stream and the downlink stream, where the data exchange is performed. It is carried out between the host and the device. 7. The system and method use the USB beacon as a separate password for the solid state disk. 8. The system and method allows the secure-and-scalable solid state disk (SNS-SSD) to replace the hard disk drive with user experience from boot-up to sleep-to-usual use. The system and method in accordance with the present invention is applicable to a flash memory, a disk storage system, a portable storage device, an enterprise storage system, a personal computer, a server, a wireless storage, and a multimedia storage system. [Embodiment] The present invention relates to a memory system. More particularly, the present invention relates to a secure and expandable solid state disk system. The following description is made to enable those skilled in the art to utilize the present invention while providing the application and conditions of the present invention. The following examples are merely illustrative of the embodiments of the invention and the technical features of the invention are not intended to limit the scope of the invention. Any arrangement or modification that can be easily accomplished by those skilled in the art is within the scope of the invention.
第3圖係為一主機系統與—usB訊標耦接至一 SATA式之安全且可 擴充之固態磁碟系統之方塊圖。主機系統30包含一處理器（圖未繪 示）3己憶體（圖未输示）、輸入/輸出（input/〇utput ; /I/〇 )、_ USB 第097丨16226號專利申請案 中文說明書及圖式替換本（丨〇丨年8月） 介面（圖未繪不）以及一 SATA主機控制器34。SATA主機控制器 係經由一 USB介面連接至一 USB訊標35，並透過—SATA主機介面 321與安全且可擴充之固態磁碟系統31共同作業。 : 於主機系統30開機之後以及存取安全且可擴充之固態磁碟系統31 •之珂，USB訊標35係作為一獨立媒介（agent)，用以提供密碼認證功 能。該功能可為一屬於該USB訊標35之軟體功能。或較佳地，該功 能可為USB訊標35中，連結至網路服務之瀏覽器連結，使用瀏覽器 連結之原因係其較普遍且其僅佔用糸統資源之一小部份即能運作於不 同平台裝置。 女全且可擴充之固邊磁碟系統31包含一第一層安全虛擬儲存控制 态32、一個第二層安全虛擬儲存控制器33以及八個第三層儲存裝置 安全數位卡10。 該第一層安全虛擬儲存控制器32包含一 SATA主機介面321、~編 碼引擎323以及並聯之複數個SATA裝置介面322。於本實施例中， • 主機端之儲存介面可為一串列ΑΤΑ或SATA。該儲存主機介面可為住 —種型式之輸入输出介面，例如SATA、串列式小型電腦系統介面 (serial attached small computer system interface ; SAS)、高速週邊押 制器介面（peripheral contr〇iier interface;pciexpress)、平行高速硬磲 介面（para丨lei advanced technology attachment ; PATA)、USB、藍芽、 超寬頻（Ultra-wideband ; UWB)或無線介面。虛擬儲存控制器32將 於第4圖所繪示之安全虛擬儲存控制器4〇中做更詳細地說明。 第二層虛擬儲存控制器33包含一 SATA主機介面331、一編碼弓丨擎 333以及並聯之被數個安全數位裝置介面幻2。虛擬健存控制器幻並 第097116226號^利^_案 中文說明書及圖式替換本（|〇1年8月） 不直絲接至快閃記賴_至第三層儲存裝置，即—安全數 位（Se賊出鉢SD)卡1〇。只要接腳數、成本系統效能合理， SD卡10可以任何—種快閃式卡或驅動器取代，例如：微型快閃卡 (compact flash card ；CFcard )^ + (multimedia compact card ； 讀^♦鶴11魏憶棒Ue贿ystidO。於本實施例中， 各安全數位卡1G具有六個㈣接腳。四健位安全元件即需要總數 4個七號接腳’其中各錢全數位卡具有兩健閃記憶體元件，而非 白去技術巾人個快閃έ己憶體元件所需之總數為㈣個信號接腳。因 此，本發明可自控㈣晶片之結構上減少-大筆花費，且具備較佳之 可製造性及可測試性。 即使第-層安全虛擬儲存控制器32及第二層安全虛擬儲存控制器 33可能具有不同型式之裝置介面，兩者之結構實質上係為相同的。只 要儲存裝置介面您與儲存主機介面如相容，第一層安全虛擬儲存 控制器32即可串接（easeaded)同時擴充更多的第二層安全虛擬健存 控制器33。據此，藉由此一擴充動作，系統之密度及效能將以指數增 加。在最簡易之安全且可擴充之固態磁碟系統的結構中，主機系統3〇 係直接與第二層虛擬儲存控㈣33其中之―㉝接。此種最小之安全且 可擴充之E]態磁碟线僅包含第二層儲存控制器33與第三層儲存裝 置10之兩層結構。 第-層之編碼引擎323與第二層之編碼引擎333皆可視需求獨立地 被致能（enable)、失能（disable)與配置（c〇nfigured)…般情況而 3 ’僅需上層之編碼引擎’其它下層之編碼引擎都將被失能。編碼引 擎將於第13圖中做更詳細地說明。 12 1373713·..·.、. *文說明書 於主機健存介面上，可利用—SATA主機介面33丨與第一層虛擬儲 子控制。。Μ輕接。在本貫施例中’儲存介面可為一串列ata或sata 虛擬儲存控制器33將於第4圖所繪示之安全虛擬儲存控制器4〇中做 更詳細地說明。 如第4圖所不’安全虛擬儲存控制器4〇包含一儲存主機介 -中斷處理器42、—主機指令及資料處理器43一_央處理單元 广一〇Cessingunit ;⑽44、—程式記鍾45、一隨機存= 憶體（random access memory ; RAM)及緩衝器牝、—資料寫入處理 器_、-資料讀取處理器402、—通行（passthr〇ugh)、指令處理^ 4〇3、-狀態與屬性擷取處理器姻、一區域指令處理器4〇5、 ^擎概、一虛擬儲存處理器407 α及複數個储存裝置介面.。 只要儲存介面相容’本發明之虛擬儲存控制器可被串接並擴充。倘 若需要增加密度’則可藉由增加第二層虛擬儲存控㈣以制擴充密 度之目標。據此’可進-步增加更多的第三層儲存裝置以擴充密度。 與習知技術相比較，本發明之安全且可擴充之固態磁碟系統可提: 數級之儲存密度擴充。 ’'曰 相較於習知技術之固態磁碟系統，本發明之安全且可擴充之固能磁 ^糸統猎由標準之快閃卡（如安全數位卡1〇)作為快閃記憶體基礎區 塊（building block)，將可帶來許多好處： 1.快閃記憶體之平均抹除被指定完成於局部之安全數位卡1〇。敕 體之快閃元件並不需要大幅度之平均抹除。 2·可製造性與可測試性係於安全數位卡之儲存裝置層進行。裝置居 與固態磁碟系統層相較，更易於管理。 ¥ 13 丄川713 第〇97丨丨6226號蝝利’申鲕案 中文說明書及圖式替換本（丨〇1年8月） 3·由於设計與發展被指定完成於安全數位卡1〇内之標準安全數位 控制器12,因此支持並取得新快閃技術之優勢即無任何時間延 遲。 上市％間更短全數位卡⑴在成本密度和系統效能許 可之下，該安全且可擴充之固態磁碟系統31即可開始販售。 5. 由於安全數位卡1G之基礎區塊結構，將可自難閃技術中省下 許多成本。 6. 由於虛擬儲存處理器32、33,系統效能得以改善。虛擬儲存處 器 Μ *Tk供虛擬儲存岔度集合（aggregati〇n )以及所需 之系統效能集合呼行運作時，理論上之系統效能將相同於安全 數位卡之數量與各安全數位卡實質上系統效能之兩者乘積。 安王f生係由硬體之編碼引擎323或333提供。密碼認證功能則獨 立地屬於-USB訊標35中。因此，該安全且可擴充之固態磁碟 系統具備較佳之系統效能以及安全性。 儲存主機介面41係用以與上傳串流主機系統30或另-上層之安全 虛擬儲存控制器輕接。儲存裝置介面4〇8係用以與下傳串流儲存裝置 10或另-下層之安全虛擬儲存控制器耦接。 八第5圖係為根據本發明另—實施例之方塊圖，其係為—具有p鳩 "面之安全且可擴充之固態磁碟系統39。主機系統5〇包含—處理器 二圖未繪示）' 記憶體（圖未繪示）、輸入輸出（圖未繪示）、- USB "面（圖未繪不）以及—PATA主機控制it 54 〇PATA主機控制器54 USB介面與—咖訊標％連接，並透過一臟主機介面训 …、有PATA介面之安全且可擴充之固態磁碟系統共同作業。 1373713.、人 第097116226號專利申請案 中文說明書及圖式替換本（丨〇丨年8月/ 該具有PATA介面之安全且可擴充之固態磁碟系統39包含一第一層 安全虛擬儲存控制器38、-第二層安全虛擬儲存控繼32、二個第三 層安全虛擬儲存㈣m 33以狀個第四層儲存裝置安全數位卡1〇。 如上所述’本發明之結構在密度和系統效能上同樣是可被擴充且串接 的 如第4圖所示，程式記髓45可财防火牆以及虛擬儲存控制器資 訊，隨機存取記憶體及緩_46財儲存諸封包肋快取（⑽㈣ 操作。 資料寫入處理器401係透過編碼引擎耗接至虛擬儲存處理器術， 編瑪引擎係用以即時進行硬體加密作業。資料可自緩衝器中被轉換、 加密並傳送至虛擬儲存處理器407。 資料讀取處理器402係透過編碼引擎耗接至虛擬儲存處理器術， 編瑪引擎係用以即時進行硬體解密作業。資料可自虛擬儲存處理器 4〇7被轉換、加密並傳送至緩衝器。 通行指令處理器彻用以處理未要求任何區域處理之指令。通行指 令係未經加密或姆即直频傳送至下傳串流。 狀態與屬性操取處理器侧回報特定狀態及/或屬性至上傳串流主 機系統’或較上層之虛擬儲存控㈣。若該狀態或雜㈣輯控制 器太多時間回報’狀態與屬性掏取處理器姻將對該請求上傳串流之 主機系統或較上層之虛擬儲存控㈣顯示—忙魏[當該特定狀離 或雜收衫«’靖處理器42以及電·行财W始作業: ^處理S42產生-軟體重置们至中央處理單元…用以使該安全 虛擬儲存控制器40進行暖開機。據此，中斷處理器似即中斷該系統 15 1373713 第097丨！6226號1 專利 中文說明書及圖式替換本（101年8月） 之上傳串流，並再次詢問虛擬儲存控制器⑼㈣報正叙狀態或屬 性。於主機與裝置以不同速度運作時，此一機制將令其同步且於同 步之要求提域，賴置需要耗f較多時間進行安排。 藉由程式記憶體45十預先規劃之—特定即如論y)，各安全虛擬 =控制器40將可被辨識。第6圖係為初始化安全虛鋪存控制器之 ’以王圖。於開機後，安全虛擬儲存控制器4。第—次被初始化的，於 步驟61巾’即觸虛擬儲存㈣器是否已麟^若是，則於步驟以 中，t主機指令處理器被啟動。否則，於步驟63中，控制器將發送一辨 ^曰^至下傳串流之儲存裝置目錄。—旦下傳串流之儲存裝置1 〇被辨 識後，該等實體儲存裝置1G於步驟64中將被賴。接著，經由步驟 5 被初始化。虛擬儲存㈣器於步驟㈣被奴為就緒。Figure 3 is a block diagram of a host system with a -usB beacon coupled to a SATA-type secure and expandable solid state disk system. The host system 30 includes a processor (not shown), a memory (not shown), an input/output (input/〇utput; /I/〇), and a USB patent application No. 097丨16226. The manual and the schema replacement (August of the following year) interface (not shown) and a SATA host controller 34. The SATA host controller is connected to a USB beacon 35 via a USB interface and works with the secure and expandable solid state disk system 31 via the SATA host interface 321 . : After the host system 30 is powered on and accessing the secure and expandable solid state disk system 31, the USB beacon 35 acts as an independent agent to provide password authentication functionality. This function can be a software function belonging to the USB beacon 35. Or preferably, the function can be a browser link connected to the web service in the USB beacon 35. The reason for using the browser link is that it is more common and only takes up a small portion of the system resources to operate. On different platform devices. The female fully expandable solid edge disk system 31 includes a first layer of secure virtual storage control state 32, a second layer of secure virtual storage controller 33, and eight third layer storage devices secure digital card 10. The first layer of secure virtual storage controller 32 includes a SATA host interface 321, a coding engine 323, and a plurality of SATA device interfaces 322 connected in parallel. In this embodiment, the storage interface on the host side can be a serial port or SATA. The storage host interface can be a live-type input/output interface, such as SATA, serial attached small computer system interface (SAS), high-speed peripheral controller interface (peripheral contr〇iier interface; pciexpress ), parallel high-speed hardware interface (PATA), USB, Bluetooth, Ultra-wideband (UWB) or wireless interface. The virtual storage controller 32 will be described in more detail in the secure virtual storage controller 4A depicted in FIG. The second layer virtual storage controller 33 includes a SATA host interface 331, a coded engine 333, and a plurality of secure digital device interfaces in parallel. Virtual Storage Controller Magic and No. 097116226 ^ Li ^_ Case Chinese Manual and Graphic Replacement (|〇1年八月) Not straight to the flash memory _ to the third layer storage device, ie - security digital (Se thief out of the SD) card 1 〇. As long as the number of pins and cost system are reasonable, the SD card 10 can be replaced by any flash card or driver, for example: compact flash card (CFcard) ^ + (multimedia compact card; read ^ ♦ crane 11 Wei Yi stick Ue bribe ystidO. In this embodiment, each secure digital card 1G has six (four) pins. The four health-care components require a total of four seven-segment pins, where each full-digit card has two flashes. The memory component, rather than the white technical towel, has a total number of (four) signal pins required for flashing the memory component. Therefore, the present invention can be self-controlled (4) the structure of the wafer is reduced - large cost, and has Good manufacturability and testability. Even though the first layer of secure virtual storage controller 32 and the second layer of secure virtual storage controller 33 may have different types of device interfaces, the structures of the two are substantially the same. The device interface is compatible with the storage host interface, and the first layer of the secure virtual storage controller 32 can be cascaded (easeaded) while expanding more of the second layer of the secure virtual memory controller 33. Accordingly, by this expansion The density and performance of the system will increase exponentially. In the structure of the most simple and secure solid state disk system, the host system 3 is directly connected to the "33" of the second layer of virtual storage control (4) 33. The smallest secure and expandable E] state disk line includes only two layers of the second layer storage controller 33 and the third layer storage device 10. The first layer encoding engine 323 and the second layer encoding engine 333 All can be independently enabled (enable), disabled (disable) and configured (c〇nfigured)... 3 'only need the upper level coding engine' other lower coding engines will be disabled. It will be explained in more detail in Figure 13. 12 1373713·..·.,. * The manual is on the host health interface, which can be controlled by the SATA host interface 33丨 and the first layer virtual storage. In the present embodiment, the storage interface can be a series of ata or sata virtual storage controllers 33. The secure virtual storage controller 4 shown in FIG. 4 will be described in more detail. 4 Figure does not 'secure virtual storage controller 4〇 contains one The storage host medium-interrupt processor 42, the host command and the data processor 43, the central processing unit, the Cessing unit; (10) 44, the program clock 45, a random access memory (random access memory; RAM) and buffer牝, - data write processor _, - data read processor 402, - passthr〇ugh, command processing ^ 4 〇 3, - state and attribute capture processor, a region command processor 4 〇5, ^ 擎, a virtual storage processor 407 α and a plurality of storage device interfaces. As long as the storage interface is compatible, the virtual storage controller of the present invention can be serially connected and expanded. If you need to increase the density, you can increase the density by adding a second layer of virtual storage control (4). According to this, more third-layer storage devices can be added to expand the density. The secure and scalable solid state disk system of the present invention provides for a number of levels of storage density expansion as compared to conventional techniques. ''The safe and scalable solid-state magnetic system of the present invention is based on a standard flash card (such as a security digital card) as a flash memory basis. A building block will bring a number of benefits: 1. The average erase of the flash memory is specified to be completed on a local secure digital card. The flash element of the body does not require a large average erase. 2. Manufacturability and testability are performed on the storage device layer of the secure digital card. The device is easier to manage than the solid state disk system layer. ¥ 13 丄川713第〇97丨丨6226蝝利's application for Chinese manual and graphic replacement (丨〇1丨〇August) 3.·Designed and developed to be completed within 1〇 of the security digital card The standard secure digital controller 12 thus supports and takes advantage of the new flash technology without any time delay. Shorter full digital card between listed companies (1) The secure and expandable solid state disk system 31 is ready for sale under cost density and system performance. 5. Due to the basic block structure of the secure digital card 1G, many costs can be saved from the difficult flash technology. 6. System performance is improved due to virtual storage processors 32,33. Virtual storage device *Tk for the virtual storage concentration set (aggregati〇n) and the required system performance set call operation, the theoretical system performance will be the same as the number of secure digital cards and each security digital card The product of both system performance. An Wang f is produced by the hardware coding engine 323 or 333. The password authentication function is independently owned by the -USB beacon 35. Therefore, the secure and scalable solid state disk system provides better system performance and security. The storage host interface 41 is for optical connection with the upload streaming host system 30 or another upper-layer secure virtual storage controller. The storage device interface 4 is configured to be coupled to the downstream streaming storage device 10 or another secure virtual storage controller. Figure 5 is a block diagram of another embodiment in accordance with the present invention, which is a secure and scalable solid state disk system 39 having a facet. The host system 5〇 includes the processor (not shown in the figure). The memory (not shown), the input and output (not shown), the USB " surface (not shown), and the PATA host control it 54 〇PATA Host Controller 54 The USB interface is connected to the _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 1373713., Japanese Patent Application No. 097116226, and a replacement of the drawings (August/August/The secure and expandable solid state disk system 39 with PATA interface includes a first layer of secure virtual storage controller 38. - The second layer of secure virtual storage control 32, two third layer of secure virtual storage (4) m 33 to form a fourth layer storage device secure digital card 1 〇. As described above, the structure of the present invention is in density and system performance. The same can be expanded and concatenated as shown in Figure 4, program memory 45 can be used for financial firewall and virtual storage controller information, random access memory and slow _46 wealth storage packet rib cache ((10) (four) operation The data writing processor 401 is consumed by the encoding engine to the virtual storage processor, and the programming engine is used for real-time hardware encryption. The data can be converted, encrypted and transmitted from the buffer to the virtual storage processor. 407. The data reading processor 402 is consumed by the encoding engine to the virtual storage processor, and the programming engine is used for real-time hardware decryption operations. The data can be self-virtual storage processor 4〇7 Convert, encrypt and transfer to the buffer. The pass instruction processor is used to process instructions that do not require any area processing. The pass command is unencrypted or transmitted directly to the downstream stream. Status and Attributes Processing Processor Side returns a specific status and/or attribute to the uploading stream host system' or a higher level virtual storage control (4). If the status or miscellaneous (four) controller has too much time to return 'state and attribute retrieval processor marriage will be the request Upload the streaming host system or the upper layer of the virtual storage control (four) display - busy Wei [when the specific shape or miscellaneous shirt «' Jing processor 42 and electricity · money to start work: ^ handle S42 production - soft weight The central processing unit is configured to warm the booting of the secure virtual storage controller 40. Accordingly, the interrupt processor seems to interrupt the system 15 1373713 No. 097丨! 6226 No. 1 patent Chinese manual and schema replacement ( (August 101) uploads the stream and asks the virtual storage controller (9) (4) to report the status or attributes again. This mechanism will synchronize and synchronize when the host and device operate at different speeds. Requiring the domain, it takes more time to arrange. With the program memory 45 pre-planned - specific as y), each security virtual = controller 40 will be identifiable. Figure 6 is Initialize the safe virtual storage controller to the king. After the boot, the secure virtual storage controller 4. The first time is initialized, in step 61, the touch virtual storage (four) device has been lining ^ if yes, then In step, the host instruction processor is started. Otherwise, in step 63, the controller will send a directory of the storage device to the downstream stream. Once the streamed storage device 1 is After identification, the physical storage devices 1G will be relied upon in step 64. Next, they are initialized via step 5. The virtual storage (four) is slaved to ready in step (4).
Ik後執仃步驟67，中斷處理器被啟動。 斷纽純彳化_。首先，經由频 =㈣k下傳串流是否有—中斷要求。若是，經由步驟74 : 73 ^上層之虛擬储存控制器，以再次配置安全虛擬控 40。步驟 軟體重置47至’央處理單元44，使該安全虛擬 制將:ΐΓ進打暖開機。於主機與裝置以不同速度運作時，此一機 〜、’、同步，其巾’該裝置於職初始化後需要耗費較多時間 女排。 ^ Χ上敘述即為初始化安全虛擬儲存控制器40之過程。 主機指令纽器執行之流程圖。該主機指令與資料處理 不㈧此ue叩）並緩衝儲存主機介面41與編碼引擎4〇6之間 16 1373713'../. 第097116226號專利申 中文說明書及圖式替換本（丨01年8 的才a 7與貢料封包。經由步驟,將擷取出來之指令佇列移交至主機 才曰7處理器之例行程序以便於步驟8丨中處理。於步驟83中，若該擷 取出來之指令佇列被判斷為一資料寫入指令，一資料寫入指令處理器 ‘ 401即於步驟8〇2中被喚醒。於步驟中若該擷取出來之指令佇列 .被判斷為一資料讀取指令，一資料讀取指令處理器402即於步驟8〇3 中被喚醒。於步驟82中，若該擷取出來之指令佇列被判斷為一通行指 令，—通行指令處理器403即於步驟801中被喚醒。於步驟85中，若 φ β操取出來之指令仔列被判斷為一狀態/屬性棟取指令，一狀態/屬性 掏取處理器404即於步驟8〇4中被喚醒。否則，一區域指令處理器4〇5 將於步驟805中被喚醒。 · 區域指令處理器4〇5處理編碼引擎406、虛擬儲存處理器407以及 區域虛擬儲存控制器40之區域函數。如第9圖所示，區域指令集90 包含：After Ik, step 67 is executed and the interrupt handler is started. Broken New Zealand _. First, whether the stream is transmitted via the frequency = (four) k is interrupted. If so, the secure virtual controller 40 is configured again via the virtual storage controller of step 74: 73. Step The software resets 47 to the central processing unit 44 so that the secure virtual system will: warm into the boot. When the host and the device operate at different speeds, the machine ~, ', sync, and its towel' need to spend more time after the device is initialized. ^ The above description is the process of initializing the secure virtual storage controller 40. A flowchart of the execution of the host command. The host command and data processing are not (eight) this ue叩) and buffer between the storage host interface 41 and the encoding engine 4〇6 16 1373713 '../. 097116226 patent application Chinese manual and schema replacement (丨01 8 After the step, the instruction sequence that has been taken out is handed over to the host computer for the routine of the 7 processor to be processed in step 8. In step 83, if the file is taken out, The command queue is judged as a data write command, and a data write command processor '401 is awakened in step 8〇2. If the command is retrieved in the step, it is judged as a data. Read command, a data read command processor 402 is woken up in step 8 。 3. In step 82, if the fetched instruction queue is determined to be a pass instruction, the pass command processor 403 It is awakened in step 801. In step 85, if the command sequence fetched by φ β is judged to be a state/attribute fetch instruction, a state/attribute fetch processor 404 is stepped in step 8〇4. Wake up. Otherwise, an area command processor 4〇5 will be in step 805 The area command processor 4〇5 processes the region functions of the encoding engine 406, the virtual storage processor 407, and the regional virtual storage controller 40. As shown in Fig. 9, the regional instruction set 90 includes:
A.使用者提供指令91 1 密碼功能指令94 1. 設定密碼941 2. 更改密碼942 3. 密碼認證943 4. 設定密碼提示944 5. 取得密碼提示945 6. 取得一嘗試（attempt)次數946 7. 初始化及分割要求947 a.設定加密金錄9471 17 1373713 b•取得新加密金鑰9472 ii. 儲存分割指令95 8·取得虛擬儲存屬性951 9. 初始化分割大小 10. 格式化953 B.區域狀態擷取92 C.廠商提供指令93 i. 虛擬儲存處理器組態96 η.取得虛擬儲存控制器識別（identity;iD)96i 12. 設定虛擬儲存模式（集束磁碟' 獨立磁4冗餘陣 列或它者）962 ii. 編碼引擎紐l態97 13. 設定編碼模式971 14. 致此編碼引擎972 15. 取得加密金錄973 . iii. 密碼屬性組態98 16. 設定主密瑪981 17·設定嘗試次數之最大值982 18. 設定管理模式旗標（flag) 983 19. 設定預設密碼984 iv. 測試模式指令99 使用者提供指令91倾專業領域應用程式㈣之，其包含USB訊 標35内之岔碼認證功能。使用者提供指令9丨包含密碼功能指令94 1373713 中文說明書及 以及儲存分割指令95。廠商係使用廠商提供指令93配置固態磁碟系 統。廠商提供指令93包含虛擬儲存處理器組態96、編碼引擎组態指 々97岔碼屬性組態98以及測試模式指令99。區域狀態操取指令％ ‘ 係用以回傳虛擬儲存控制器之相應狀態。 . 取得虛擬儲存控制器ID指令961係用以回傳儲存於程式記憶體45 之特定ID。設定虛擬财模式指令％2可視系統效能之需求或功率消 耗，設定集束磁碟（just a bunch of disks ; JB〇D) '獨立磁碟冗餘陣列 • (redundant arrays 〇findePendent disks ; RAID)或它者之操作模式。 設定編碼模式指彳971係用以設定編碼引擎之加密模式。致能編碼引 擎指令972係用以致能編碼引擎。設定管理模式旗標撕肖以於使用 2 (in the field)允許或禁止提供固態磁碟系統。若該旗標被設定為非 管理模式’則必須糊USB訊標以再次提供並初始化該固態磁碟系 統。若該旗標被狀為管理m彳制者必須相至管糊服器， 以再次提供及初純_磁射、統。該難健由絲設^測試模 •式才曰令99可由製造商保自（reserved) 1乂測試固態磁碟系統。 於就緒使狀前，固態磁❹統於製作過程間必須先通過廠商準 鎊如第3圖所不，違準備係藉由將安全且可擴充之固態磁碟系統η .缝-適當的MTA主機控制器34或一咖訊標％連結至一主機系統 扣而達成。第1G圖係為配置簡商準備之流程圖。首先於步驟即， 等待安全虛擬儲存控㈣就緒。當控制器就緒之後，廠商預設設定值 ;v驟102中被載入。於步驟1〇3中該虛擬儲存處理器開始被配置。 之後，於步驟1〇4巾’該編碼引擎開始被配置。而於步驟ι〇5中則 規需求致能編碼引擎。 19 1373713 第097丨16226號'專利申’請案 中文說明書及圖式替換本（1〇1年8月） 第丨1圖係為配置虛擬儲存處理器之流程圖。如第11圖所示，於步 驟中，虛擬儲存模式被設定，即利用該等區域指令其中之一設定 虛擬儲存模式962 虛擬_操作模式可被設定為腦D、RAID或它 者因此，根據貫體儲存裝置目錄64 (請參閱第6圖），一虛擬儲存 π &於步驟112便已完成。建立一虛擬儲存識別目錄。於步驟113中， 一虛擬儲存裝置目錄被建立。經由步驟114，利用虛擬儲存處理器仙7 (明參閱第4圖）建立-實體至邏輯位址轉換目錄。隨後，於步驟ιΐ5 中，該虛擬儲存處理器被設定為就緒狀態。 第12圖為配置編碼引擎之流程圖。於步驟121巾，經由該等區域指 令其中之-配置編瑪引擎，並發送一編碼模式設定指令971。接著， 於步驟122令’發送一嘗試設定次數最大值之指令982。於步驟⑵〇 中，發送一取得加密金鑰指令973。因此，於編碼引擎4〇6中，將利 用-綠產生器娜134產生—亂數金鑰（圖未繪示）。該亂數金輪 於步驟mo中被加密並回傳以取得加密金输指令奶。若於步驟咖 中要求-主密碼，躲轉丨222巾初始化—取得主密碼指令程序並發 送-設定主密碼指令％卜於步驟⑵中，判斷旗標是否為管理模式: 若疋貝j於步驟I24中’視需求將該加密金錄儲存於管理饲服^、。从 否’則經由步驟125 ’將該加密金錄儲存於USB訊標35。於步驟u 中’經由密碼設定指令981發送主密碼至編碼引擎。接著，加密6 主密碼將被儲存於固n磁餐、統巾（圖未繪示）。於步驟咖中，= 由指令984設定-預設密碼。接著，加密後之預設密碼將被健存於乂 態磁碟系統中（®未繪示）。而編碼引擎可被失能或致能。若；口 被致能’編碼引擎於步驟127中，可視需求被設定為執行—特定^ 20 1373713 ‘ 第〇97丨丨6226號專利申請案 中文說明書及圖式替換本（101年8月） 模式。隨後’編碼引擎準備旗標 第13圖係為編碼引擎之方塊 記於步驟128中被設為就緒。 圖。編碼引擎406包含一亂數產生 器 RNG 134、一雜湊函數 HASH 131 一第二資料加密引擎ENG3 133、 、—第一通用加密引擎ENG2 132、 —儲存上傳串流介面135以及一儲 存下傳串流介面136。編瑞引塾夕％ Λ — 勒％ ^擎之砰細貫施方式請參閱美國專利申請 案第 11/643,101 號。 主機系統30將取決於插入之USB訊標％進行密碼認證。請參閱第 14A圖’於步驟14〇巾，主機系统3〇經由冷開機之後。於步驟⑷ 中’ USB蘇35同樣冷開機。並經由步驟142啟動USB訊標操作。 請參閱S 14B目’於步驟143中，主機系統3〇關機之後。於步驟 144中固態磁碟系統同樣關機。而由於電力中斷於步驟145中， 固態磁碟系統中之加密金麟遺失。於步驟146巾，只要加密金錄尚 未透過載人USB· 35之密碼認證功能回復，則翻態磁碟系統將 會維持加密。 請參閱第14D_，於步驟14〇3巾，主機系統3〇休眠之後。於步驟 1404中’固態磁碟系統同樣休眠。而由於電力中斷於步驟中， 固態磁碟系統之加密錢將遺失。於步驟剛巾/。'要加密金錄尚未 、’二由載入USB訊標35之密碼認證功能回復，則該固態磁碟系統將會 維持加密狀態。 凊參閱第14C圖，於步驟1400中，當主機系統30自休眠中被喚醒 之後。於步驟1401中，usb訊標35同樣冷開機，即如同第14A圖所 繪不。最後’於步驟1402中，啟動USB訊標操作。 第15圖為USB訊標開機之流程圖。如第丨5圖所示，於步驟ι51 2! 1373713 第097丨丨6226號'專利申請案 中文說明書及圖式替換本（1〇|年8月） 中，一旦USB訊標網路伺服器開機。於步驟152中，該USB訊標等 待儲存器與編碼引擎準備為就緒狀態。接著於步驟153中，啟動密碼 認證功能。該密碼認證功能之詳細實施步驟請參閱美國專利申請案第 11/643,101 號。 於步驟154中，若經由使用者指令947產生初始與分割要求則編碼 引擎將自亂數產生is 134取得一新亂數金錄（圖未繪示）。而後，於步 驟1541中，該旗標將被判斷是否為管理模式。若否，則於步驟 中，自USB訊標35操取加密金繪。否則，即於步驟I%〗中’自管理 伺服器擷取加密金鑰。隨後’於步驟1544中，該加密金鑰經由設定加 密金输指令9471被發送至編碼引擎。編碼㈣解密麵取該金錄（圖 未繪示编碼引擎（圖未繪示）擷取並解密該加密之主密碼。隨後， 自亂數產生器麟134 (圖未繪示）產生—魏數金錄。該主密碼可 藉由編碼引擎（圖未綠示）使用該新金鑰加密。於步驟⑽中，該功 能將經由初始化-取得新加密金錄指令9472。於步驟1546、⑽中， 可視需求㈣加密金_辆管理舰料聰訊標％巾。於步驟 ⑽中，使用者要求並配置新使用者密碼。主密碼與使用者密碼賴 由雜湊函數⑶重新產生並儲存於固態磁碟系統（圖未繪示並於步 驟1549中，组態該固態磁碟系統分割。 倘若該要求並非初始化及分割，則於步驟155中’將判斷是否產生 1碼認證請求。若是，則於步雜⑽中啟動密碼認證。若否，將 於步驟156中，判斷是否有產生一 啕座生更改狁碼請求。若是，則於步驟Μ? 中，啟動岔碼更改功能。否則將 由/驟154，回到步驟155中，繼 績判斷是衫新㈣碼賴料。 Τ 22 1373713 = 第097丨丨6226號專利申請案 中文說明書及圖式替換本（1〇丨年8月） 第16圖係為密碼認證之流程圖。首先，於步驟161 +，判斷該密碼 是否已被認證。若是’則於步驟164帽取並載人該編碼引擎金錄至 編碼引擎中’同時開啟存取。隨後，於步雜165中，卸載（細麵t) USB訊標。步驟166 +，該固態磁碟系統被安裝。於步驟167，控制 權轉移至該ID態磁碟系統。若密碼未被認證，於步驟162中判斷是 否超出嘗。式-人數表大值（maximum number 〇f咖叫化；。 若結果為肯定，則於步驟163中，啟動一反擊測量（咖_腦_) 以抵抗惡意攻擊。否則，於步驟168巾，增加該f試次數（η·— attempts ; NOA)之計數。最後於步驟169中結束並返回第i5圖繪示 之密碼迴圈之步驟154。 儘管根據本發明之安全且可擴充之固態磁碟系統可操作於安全數位 卡、多媒體卡、微型快閃卡 '聰裝置、記憶棒、高速卡、邏輯區塊 疋址-反及（logical block addressing-NAND ; LBA-NAND)、開放式反 及快閃記憶體介面（open NAND flash interface ; 〇Νπ )、内嵌式多媒 體卡（embed multimedia card; eMMC)與内嵌式安全數位卡（咖_ security digital card ; eSD)之任一介面。所屬領域之技術者可輕易地 將該磁碟纽置換成任—麵似的記憶體裝置同時並不違反本發明 之精神及保護範疇。 上述之實施例僅用來例舉本發明之實施態樣，以及闊釋本發明之技 術特徵，來關本發明之倾料。任何熟悉此技術者可輕易 完成之改變或均雜之㈣均屬於本發明所域之顧，本發明之權 利保護範圍應以申請專利範圍為準。 【圖式簡單說明】 23 1373713 第097116226號專利申請案 中文說明書及圖式替換本（101年8月） 第1圖係為習知技術之一安全數位卡之方塊圖； 第2圖係為習知技術之一主機系統與一習知固態磁碟系統之耦接示 意圖； 第3圖係為一主機系統與一 USB訊標耦接至一基於三層結構之 SATA式安全且可擴充之固態磁碟統之方塊圖； 第4圖係為安全虛擬儲存控制器之方塊圖； 第5圖係為一主機系統與一 USB訊標耦接至一基於四層結構之 PATA式安全且可擴充之固態磁碟系統之方塊圖； 第6圖係為初始化該安全虛擬儲存控制器之流程圖； 第7圖係為中斷處理器執行之流程圖； 第8圖係為主機命令處理器執行之流程圖； 第9圖係為安全虛擬儲存控制器之區域命令處理器，其内部之區域 命令表； 第10圖係為執行廠商準備之流程圖； 第11圖係為配置該虛擬儲存處理器之流程圖； 第12圖係為配置編碼引擎之流程圖； 第13圖係為該編碼引擎之方塊圖； 第14A-14D圖分別為該主機系統之冷開機、關機、休眠以及由休眠 被喚醒之流程圖； 第15圖係為USB訊標開機之流程圖；以及 第16圖係為密碼認證之流程圖。 【主要元件符號說明】 10 :安全數位卡 1373713 · 第097116226號專利申請案 中文說明書及圖式替換本（101年8月） 11 :實體介面 12 :安全數位卡控制器 13 :快閃記憶體 14 :介面匯流排 131 :雜凑函數HASH 132:第一通用加密引擎ENG2 133 :第二資料加密引擎ENG3A. User provides instruction 91 1 Password function command 94 1. Set password 941 2. Change password 942 3. Password authentication 943 4. Set password prompt 944 5. Get password prompt 945 6. Get an attempt (946) times 946 7 Initialization and splitting requirements 947 a. Set the encrypted gold record 9471 17 1373713 b• Obtain the new encryption key 9472 ii. Store the split instruction 95 8. Get the virtual storage attribute 951 9. Initialize the split size 10. Format 953 B. Area status Capture 92 C. Vendor-supplied instructions 93 i. Virtual Storage Processor Configuration 96 η. Obtain virtual storage controller identification (identity; iD) 96i 12. Set virtual storage mode (clustered disk 'independent magnetic 4 redundant array or Others) 962 ii. Coding Engine New State 97 13. Set Encoding Mode 971 14. To this Coding Engine 972 15. Obtain Encrypted Gold Record 973. iii. Password Attribute Configuration 98 16. Set Main Mima 981 17·Setting The maximum number of attempts is 982 18. Set the management mode flag (flag) 983 19. Set the default password 984 iv. Test mode command 99 The user provides the command 91 professional domain application (4), which contains the USB signal 35 The weight authentication function. The user provides the command 9 and includes the password function command 94 1373713 Chinese manual and the storage split command 95. The manufacturer uses the manufacturer's instructions 93 to configure the solid state disk system. The vendor-provided instructions 93 include a virtual storage processor configuration 96, an encoding engine configuration index 97 属性 property configuration 98, and a test mode command 99. The zone status fetch instruction % ‘ is used to return the corresponding state of the virtual storage controller. The virtual storage controller ID command 961 is used to return the specific ID stored in the program memory 45. Set the virtual currency mode command %2 visual system performance requirements or power consumption, set a bunch of disks (JB〇D) 'redundant arrays 〇findePendent disks (RAID) or it The mode of operation. Setting the encoding mode refers to the 971 system used to set the encryption mode of the encoding engine. The Enable Code Engine Instruction 972 is used to enable the code engine. Set the management mode flag to allow or disable the provision of a solid state disk system using 2 (in the field). If the flag is set to unmanaged mode, then the USB beacon must be pasted to provide and initialize the solid state disk system again. If the flag is managed as a management system, it must be connected to the pipe paste to provide the original pure magnetic radiation. The refractory is set by the tester. The test can be maintained by the manufacturer to test the solid state disk system. Before the ready-to-use, the solid-state magnetic system must pass the manufacturer's quasi-pounds as shown in Figure 3 during the production process. The preparation is based on the safety and expandable solid-state disk system. The controller 34 or a coffee message is linked to a host system to achieve. The 1G chart is a flow chart for configuring the simplification. First, at the step, wait for the secure virtual storage control (4) to be ready. When the controller is ready, the manufacturer presets the set value; v is loaded in step 102. The virtual storage processor begins to be configured in step 1-3. After that, the encoding engine starts to be configured in step 1. In step ι〇5, it is required to enable the encoding engine. 19 1373713 No. 097丨16226 'Patent Application' Case Chinese Manual and Drawing Replacement (August 1st) Figure 1 is a flow chart for configuring a virtual storage processor. As shown in FIG. 11, in the step, the virtual storage mode is set, that is, using one of the regional instructions to set the virtual storage mode 962. The virtual_operation mode can be set to brain D, RAID or others. The physical storage device directory 64 (see Figure 6), a virtual storage π & is completed in step 112. Create a virtual storage identification directory. In step 113, a virtual storage device directory is created. Via step 114, the virtual storage processor 7 (see Figure 4) is used to establish a physical-to-logical address translation directory. Subsequently, in step ιΐ5, the virtual storage processor is set to the ready state. Figure 12 is a flow chart of configuring the encoding engine. In step 121, the comma engine is configured via these areas, and an encoding mode setting command 971 is sent. Next, in step 122, 'A command 982 to attempt a set maximum number of times is sent. In step (2), a get encryption key command 973 is sent. Therefore, in the coding engine 4〇6, the use-green generator 134 generates a random number key (not shown). The random number of gold wheels is encrypted and returned in step mo to obtain the encrypted gold input command milk. If the request in the step coffee - master password, do not 222 towel initialization - get the master password command program and send - set the master password command % in step (2), determine whether the flag is in the management mode: If the shell in step j In I24, the encrypted gold record is stored in the management feeding service as required. From no, the encrypted record is stored in the USB beacon 35 via step 125'. The master password is sent to the encoding engine via the password setting command 981 in step u. Then, the encrypted 6 master password will be stored in the solid magnetic meal, the towel (not shown). In the step coffee, = is set by the command 984 - the default password. The encrypted default password will then be saved in the internal disk system (® not shown). The encoding engine can be disabled or enabled. If the port is enabled 'encoding engine' in step 127, the visual requirements are set to execute - specific ^ 20 1373713 'patent application No. 97丨丨6226 Chinese application and schema replacement (August 101) mode . Subsequent 'Code Engine Readiness Flag' Figure 13 is the block of the code engine. It is set to Ready in step 128. Figure. The encoding engine 406 includes a random number generator RNG 134, a hash function HASH 131, a second data encryption engine ENG3 133, a first universal encryption engine ENG2 132, a storage upload stream interface 135, and a storage downstream stream. Interface 136.编瑞塾塾塾% Λ — 勒% 擎 砰 砰 请 请 请 请 请 请 请 请 请 请 请 请 请 请 请 请 请 请 请 请 请 请 美国 美国 美国 美国The host system 30 will perform password authentication depending on the inserted USB symbol %. Referring to Figure 14A, in step 14, the host system 3 is turned on after cold booting. In step (4), the USB Su 35 is also cold booting. And via step 142, the USB beacon operation is initiated. Please refer to S 14B. In step 143, the host system 3 is turned off. The solid state disk system is also turned off in step 144. And because the power is interrupted in step 145, the encrypted Jinlin in the solid state disk system is lost. In step 146, the flip disk system will maintain encryption as long as the encrypted gold record has not been replied by the password authentication function of the manned USB·35. Please refer to page 14D_, after step 14〇3, after the host system 3〇 sleeps. In step 1404, the solid state disk system also sleeps. And because the power is interrupted in the steps, the encrypted money of the solid-state disk system will be lost. In the step just towel /. 'To encrypt the gold record yet,' and the second solid disk system will maintain the encryption state by the password authentication function of the USB signal 35. Referring to Figure 14C, in step 1400, host system 30 wakes up from sleep. In step 1401, the usb beacon 35 is also cold-booted, i.e., as depicted in Figure 14A. Finally, in step 1402, the USB beacon operation is initiated. Figure 15 is a flow chart of USB signal activation. As shown in Figure 5, in the ι 51 2! 1373713 No. 097丨丨6226 'patent application Chinese manual and graphic replacement (1〇|August), once the USB beacon network server is turned on . In step 152, the USB beacon waits for the storage and encoding engine to be ready. Next in step 153, the password authentication function is activated. For detailed implementation steps of the password authentication function, see U.S. Patent Application Serial No. 11/643,101. In step 154, if the initial and split requests are generated via the user command 947, the encoding engine will obtain a new random number record (not shown) from the random number generation is 134. Then, in step 1541, the flag will be judged whether it is in the management mode. If not, in the step, the encrypted gold is drawn from the USB beacon 35. Otherwise, the encryption key is retrieved from the management server in step I%. Then, in step 1544, the encryption key is sent to the encoding engine via the set cryptographic input command 9471. The code (4) decryption surface takes the gold record (the code engine (not shown) is not shown to capture and decrypt the encrypted master password. Subsequently, the random number generator 134 (not shown) generates - Wei The master password can be encrypted by the encoding engine (not shown) using the new key. In step (10), the function will be initialized to obtain a new encrypted record command 9472. In steps 1546, (10) , visual requirements (4) encryption gold _ vehicle management ship material concealed standard% towel. In step (10), the user requests and configures a new user password. The master password and user password are regenerated by the hash function (3) and stored in solid magnetic The disc system (not shown and configured in step 1549, the solid state disc system partitioning. If the request is not initialization and splitting, then in step 155 'will determine whether a 1 code authentication request is generated. If yes, then step In step (10), password authentication is initiated. If not, it is determined in step 156 whether a request to generate a change weight is generated. If so, in step Μ?, the weight change function is activated. Otherwise, Go back to step 155 The succession judgment is the shirt new (four) code. Τ 22 1373713 = No. 097丨丨6226 patent application Chinese manual and schema replacement (August 1st) Figure 16 is the flow chart of password authentication First, in step 161+, it is determined whether the password has been authenticated. If yes, then in step 164, the code is captured and the encoding engine is recorded in the encoding engine to open the access. Then, in step 165, Unloading (fine t t) USB beacon. Step 166 +, the solid state disk system is installed. In step 167, control is transferred to the ID state disk system. If the password is not authenticated, it is determined in step 162 whether it is exceeded. Taste the maximum number of people (maximum number 咖f coffee; if the result is affirmative, then in step 163, start a counterattack measurement (Caf_Brain_) to resist malicious attacks. Otherwise, in step 168 The count of the number of f trials (η·- attempts; NOA) is increased. Finally, in step 169, the process returns to step 154 of the password loop shown in Figure i5. Despite the safe and scalable solid state magnetic field according to the present invention. The disc system can operate on a secure digital card, and more Body card, micro flash card 'Cong device, memory stick, high speed card, logic block address-reverse (logical block addressing-NAND; LBA-NAND), open anti-flash memory interface (open NAND flash Interface; 〇Νπ), any interface of an embedded multimedia card (eMMC) and an embedded secure digital card (eSD). The person skilled in the art can easily apply the magnetic The replacement of the disc button into a face-like memory device does not violate the spirit and protection of the present invention. The above-described embodiments are merely illustrative of the embodiments of the present invention, and the technical features of the present invention are widely disclosed to the present invention. Any changes or duplications that can be easily accomplished by those skilled in the art are intended to be within the scope of the present invention. The scope of the present invention should be determined by the scope of the patent application. [Simplified description of the drawings] 23 1373713 Patent application No. 097116226 Chinese specification and schema replacement (August, 101) Figure 1 is a block diagram of a secure digital card of the prior art; A schematic diagram of coupling of a host system and a conventional solid state disk system; FIG. 3 is a host system coupled with a USB signal to a SATA-based secure and expandable solid state magnetic based on a three-layer structure Figure 4 is a block diagram of a secure virtual storage controller; Figure 5 is a host system coupled to a USB beacon to a four-layer PATA-based secure and expandable solid state Block diagram of the disk system; Figure 6 is a flow chart for initializing the secure virtual storage controller; Figure 7 is a flow chart for executing the interrupt processor; Figure 8 is a flow chart for executing the host command processor; Figure 9 is a regional command processor of the secure virtual storage controller, its internal regional command table; Figure 10 is a flow chart for executing the manufacturer; Figure 11 is a flow chart for configuring the virtual storage processor; Figure 12 A flowchart for configuring the encoding engine; Figure 13 is a block diagram of the encoding engine; and Figures 14A-14D are flowcharts of cold booting, shutdown, hibernation, and wake-up by sleep of the host system; A flowchart for booting a USB beacon; and Figure 16 is a flow chart for password authentication. [Main component symbol description] 10: Secure digital card 1373713 · Patent application No. 097116226 Chinese version and schema replacement (August, 2011) 11: Physical interface 12: Secure digital card controller 13: Flash memory 14 : interface bus 131: hash function HASH 132: first universal encryption engine ENG2 133: second data encryption engine ENG3
134 :亂數產生器RNG 135 :儲存上傳串流介面 136:儲存下傳串流介面 20 :主機系統 21 : SATA主機控制器 25 : SATA至快閃記憶體控制器 251 : SATA主機介面 252 :快閃裝置介面 30 :主機系統 31 :安全且可擴充之固態磁碟系統 32:第一層安全虛擬儲存控制器 33 :第二層安全虛擬儲存控制器 34 : SATA主機控制器 35 : USB訊標 38:第一層安全虛擬儲存控制器 39 :安全且可擴充之固態磁碟系統 25 1373713 第097丨丨6226號專利申請案 中文說明書及圖式替換本（101年8月） 321 : SATA主機介面 322 : SATA裝置介面 323 :編碼引擎 331 : SATA主機介面 332 :安全數位介面 333 :編碼引擎 381 : PATA主機介面 383 :編碼引擎 40 :安全虛擬儲存控制器 41 :儲存主機介面 42 :中斷處理器 43 :主機指令/資料處理器 44 :中央處理單元 45 :程式記憶體 46 :隨機存取記憶體/緩衝器 47 :重置 401 :資料寫入處理器 402 :資料讀取處理器 403 :通行指令處理器 404 :狀態與屬性擷取處理器 405 :區域指令處理器 406 :編碼引擎 407 :虛擬儲存處理器 1373713 第097116226號專利申請案 中文說明書及圖式替換本（101年8月） 408 :儲存裝置介面 50 :主機系統 54 : PATA主機控制器 90 :區域指令集 91 :使用者提供指令 92 :區域狀態擷取 93 :廠商提供指令134: Random Number Generator RNG 135: Store Upload Streaming Interface 136: Store Downstream Streaming Interface 20: Host System 21: SATA Host Controller 25: SATA to Flash Memory Controller 251: SATA Host Interface 252: Fast Flash device interface 30: host system 31: secure and expandable solid state disk system 32: first layer secure virtual storage controller 33: second layer secure virtual storage controller 34: SATA host controller 35: USB beacon 38 : The first layer of secure virtual storage controller 39: Secure and expandable solid state disk system 25 1373713 Patent application No. 097-6226 Chinese specification and schema replacement (August 101) 321 : SATA host interface 322 : SATA Device Interface 323: Encoding Engine 331: SATA Host Interface 332: Secure Digital Interface 333: Encoding Engine 381: PATA Host Interface 383: Encoding Engine 40: Secure Virtual Storage Controller 41: Storage Host Interface 42: Interrupt Processor 43: Host command/data processor 44: central processing unit 45: program memory 46: random access memory/buffer 47: reset 401: data write processor 402: data read processor 403: Line Instruction Processor 404: State and Attribute Acquisition Processor 405: Area Instruction Processor 406: Encoding Engine 407: Virtual Storage Processor 1373713 Patent Application No. 097116226 Chinese Specification and Graphical Replacement (August 101) 408 : Storage Device Interface 50: Host System 54: PATA Host Controller 90: Zone Command Set 91: User Provides Command 92: Zone Status Capture 93: Vendor Provides Instructions
94 :密碼功能指令 95 :儲存分割指令 96 :虛擬儲存處理器組態 97 :編碼引擎組態 98 :密碼屬性組態 99 :測試模式指令 941 :設定密碼 942 :更改密碼94: Password function instruction 95: Store split instruction 96: Virtual storage processor configuration 97: Encoding engine configuration 98: Password attribute configuration 99: Test mode command 941: Set password 942: Change password
943 :密碼認證 944 :設定密碼提示 945 :取得密碼提示 946 :取得一嘗試次數 947 :初始化及分割要求 9471 :設定加密金鑰 9472 :取得新加密金鑰 951 :取得虛擬儲存屬性 27 1373713 第097116226號專利申請案 中文說明書及圖式替換本（101年8月） 952 :初始化分割大小 953 :格式化 961 :取得虛擬儲存控制器識別 962 :設定虛擬儲存模式 971 :設定編碼模式 972 :致能編碼引擎 973 :取得加密金鑰 981 :設定主密碼 982 :設定嘗試次數之最大值 983 :設定管理模式旗標 984 :設定預設密碼943: Password authentication 944: Set password prompt 945: Get password prompt 946: Get a number of attempts 947: Initialization and split request 9471: Set encryption key 9472: Get new encryption key 951: Get virtual storage attribute 27 1373713 No. 097116226 Patent Application Chinese Manual and Graphical Replacement (August 101) 952: Initialization Split Size 953: Format 961: Get Virtual Storage Controller Identification 962: Set Virtual Storage Mode 971: Set Encoding Mode 972: Enable Encoding Engine 973: Acquire encryption key 981: Set master password 982: Set the maximum number of attempts 983: Set management mode flag 984: Set preset password