Storage system and data processing method
A storage system in which a controller has an encryption-related function is provided. There is provided a storage system including an interface section coupled to one or more storages and a controller that carries out reading and writing processes on the storages via the interface section. The controller includes an arithmetic processing section, a memory, and an encryption processing section. The arithmetic processing section causes the memory to hold data before processing and data after processing by the encryption processing section, and limits the access destination from the storages to the memory. The configuration and actions described above allow the storage system to avoid occurrence of deadlock and the controller to have an encryption-related function.
1. A storage system comprising:
an interface section coupled to one or more storages; and
a controller that carries out reading and writing processes on the storages via the interface section,
wherein the controller includes:
a central processing unit (CPU);
a memory coupled to the CPU, the memory having a buffer area and a cache area; and
an encryption processor,
wherein the CPU is configured to:
cause the memory to hold plaintext data and encrypted data encrypted by the encryption processor, and
limit an access destination of each of the storages to only the buffer area of the memory, and
issue a transfer instruction to the encryption processor,
wherein the encryption processor is configured to:
in response to receiving the transfer instruction from the CPU, acquire the plaintext data from the buffer area of the memory, encrypt the data to generate encrypted data of the plaintext data, and overwrite the plaintext data in the buffer area with the encrypted data.
2. The storage system according to claim 1 ,
wherein the controller includes a plurality of controllers including a first controller and a second controller, each having a memory, a CPU, and an encryption processor, and
wherein the processor of the first controller is configured to:
cause a buffer area of the first controller to hold data acquired from the second controller.
3. The storage system according to claim 1 ,
wherein the CPU is configured to cause the buffer area to hold the encrypted data read from any of the storages, and
wherein the encryption processor is configured to acquire the encrypted data from the buffer area, decrypt the encrypted data to generate decrypted data, and overwrite the encrypted data in the buffer area with the decrypted data.
4. A data processing method executed by a controller coupled to a storage via an interface section, the method comprising:
storing, by a CPU provided in the controller plaintext data in a buffer area of a memory;
limiting an access destination of each of a plurality of storages to only the buffer area of the memory;
issuing a transfer instruction to an encryption processor;
in response to receiving the transfer instruction from the CPU, acquiring, by the encryption processor, the plaintext data from the buffer area of the memory, encrypting the data to generate encrypted data of the plaintext data, and overwriting the plaintext data in the buffer with the encrypted data.