Storage device
A storage device includes a storage and a controller. The storage includes a plurality of sections. The controller executes control of the storage. The control includes writing data to the storage and reading data from the storage, in response to a command from a host. The controller includes a security control unit that applies a data protection processing method compliant with a first specification or a second specification, to protect data in the storage. The security control unit applies a first data protection processing method compliant with the first specification to a first section of the plurality of sections and a second data protection processing method compliant with the second specification to a second section of the plurality of sections.
1. A storage device comprising:
a nonvolatile storage in which a plurality of namespaces is set, each of the namespaces being assigned with a certain logical address range; and
a controller configured to:
in response to a first command to activate a first namespace included in the plurality of namespaces, apply, selectively to the first namespace, a first data protection processing method compliant with a first storage specification of a Security Subsystem Class (SSC), which defines a first manner of assigning encryption keys, performing a pre-boot authentication, and performing read and write restrictions, in accordance with a first parameter in the first command that indicates the first namespace; and
in response to a second command to activate a second namespace included in the plurality of namespaces, apply, selectively to the second namespace, a second data protection processing method compliant with a second storage specification of the SSC, which defines a second manner of assigning encryption keys, performing the pre-boot authentication, and performing read and write restrictions, in accordance with a second parameter in the second command that indicates the second namespace, the second storage specification being different from the first storage specification, wherein
the controller is capable of making the first and second data protecting processing methods concurrently applied to the first and second namespaces, respectively.
2. The storage device according to claim 1 , wherein
the controller includes a security control circuit, which includes
at least one first data protection processing unit configured to execute the first data protection processing method, and
a second data protection processing unit configured to execute the second data protection processing method, and
the security control circuit is configured to allocate the first data protection processing unit to the first namespace and the second data protection processing unit to the second namespace.
3. The storage device according to claim 2 , wherein
in response to a delete command to delete a namespace from the plurality of namespaces, the security control circuit deletes the namespace if neither the first data protection processing unit nor the second data protection processing unit is allocated thereto, and does not delete the namespace if one of the first data protection processing unit and the second data protection processing unit is allocated thereto.
4. The storage device according to claim 3 , wherein
the security control circuit further includes a management unit configured to execute lifecycle management on the first data protection processing unit and the second data protection processing unit, the lifecycle management including activating and deactivating the first data protection processing unit and the second data protection processing unit.
5. The storage device according to claim 4 , wherein
in response to a command to activate the first or second data protection processing unit for a namespace of the plurality of namespaces, the management unit sets a number of divisible areas in the namespace according to a parameter specified in the command.
6. The storage device according to claim 3 , wherein
the security control circuit further includes
a first management unit configured to execute lifecycle management on the first data protection processing unit including activating and deactivating the first data protection processing unit, and
a second management unit configured to execute lifecycle management on the second data protection processing unit including activating and deactivating the second data protection processing unit.
7. The storage device according to claim 6 , wherein
in response to a first command to activate the at least one first data protection processing unit for a namespace of the plurality of namespaces, the first management unit sets a number of divisible areas in the namespace according to a parameter specified in the first command, and
in response to a second command to activate the second data protection processing unit for a namespace of the plurality of namespaces, the second management unit sets a number of divisible areas in the namespace according to a parameter specified in the second command.
8. The storage device according to claim 6 , wherein
in response to a deactivation command, at least one of the first management unit and the second management unit deactivates both the first data protection processing unit and the second data protection processing unit.
9. The storage device according to claim 2 , wherein
the at least one first data protection processing unit comprises a plurality of first data protection processing units,
the plurality of first data protection processing units are respectively allocated to different namespaces of the plurality of namespaces and share an authentication program configured to authenticate a user when an access to a Master Boot Record (MBR) is requested.
10. The storage device according to claim 2 , wherein
the controller reports a function provided by the security control circuit to the host.
11. The storage device according to claim 1 , wherein the nonvolatile storage is a Solid State Drive (SSD).
12. The storage device according to claim 1 , wherein the first storage specification is one of Opal, Enterprise, Pyrite, and Ruby, and the second storage specification is another one of Opal, Enterprise, Pyrite, and Ruby.