Memory system
A memory system includes a nonvolatile memory including user areas, a volatile memory, a battery, and a controller configured to, when the volatile memory maintains first information indicating an access to a user area is permitted and a verification value upon startup of the system, determine whether the information is validated by the value, and upon determining that the information is validated, permit an access to the user area and prohibit the access to any other area, and when the volatile memory does not maintain the information and value, or the information is not validated, prohibit an access to any user area, and thereafter, upon receipt of a command and authentication information from the host, permit an access to the user area requested by the command, and generate and store in the volatile memory the information and the value for validating the generated information.
1. A memory system capable of communicating with a host, comprising:
a nonvolatile memory including a plurality of predetermined user areas;
a volatile memory;
a battery capable of supplying power to the memory system when power supply from an external power source is interrupted; and
a controller configured to
when the volatile memory maintains first information indicating that an access to at least one of the user areas is permitted and a verification value for validating the first information upon startup of the memory system,
determine whether or not the first information is validated by the verification value, and
upon determining that the first information is validated, permit an access from the host to said at least one of the user areas and prohibit the access to any user area other than said at least one of the user areas, and
when the volatile memory does not maintain the first information and the verification value, or the volatile memory maintains the first information and the verification value but the first information is not validated,
prohibit an access from the host to any user area, and
thereafter, upon receipt of a command to request for an access to a user area and valid authentication information from the host, permit the access to the user area, generate first information indicating that the access to the user area is permitted and a verification value for validating the generated first information, and store the generated first information and verification value in the volatile memory.
2. The memory system according to claim 1 , further comprising:
an encryption circuit including a register, wherein
the controller is configured to, when the volatile memory maintains the first information and the verification value and the first information is validated, after permitting the access to said at least one of the user areas, acquire a first encryption key to access said at least one of the user areas, and store the acquired first encryption key in the register.
3. The memory system according to claim 2 , wherein
the controller is configured to, when the volatile memory does not maintain the first information and the verification value, or the volatile memory maintains the first information and the verification value but the first information is not validated, after permitting the access to the user area, acquire a first encryption key to access the user area, and store the acquired first encryption key in the register.
4. The memory system according to claim 3 , wherein
the nonvolatile memory includes a system area that stores an encrypted first encryption key to access each user area, and
the controller is configured to acquire the first encryption key to access said at least one of the user areas or the user area requested by the command the user area by decrypting a corresponding encrypted first encryption key.
5. The memory system according to claim 4 , wherein
the first information includes a random number and an encrypted second encryption key, and
when the volatile memory maintains the first information and the verification value and the first information is validated, the first encryption key is acquired by
generating a third encryption key using the random number,
decrypting the encrypted second encryption key with the third encryption key, and
decrypting the corresponding encrypted first encryption key stored in the system area with the second encryption key.
6. The memory system according to claim 4 , wherein
when the volatile memory does not maintain the first information and the verification value, or the volatile memory maintains the first information and the verification value but the first information is not validated, the first information is generated by
generating a second encryption key from the authentication information received from the host,
generating a third encryption key by using a random number,
encrypting the second encryption key with the third encryption key, and
generating the first information indicating that the access to the user area requested by the command is permitted and including the random number and the encrypted second encryption key.
7. The memory system according to claim 2 , wherein
the encryption circuit is configured to encrypt data to be written to the user area with the first encryption key, and decrypt data read from the user area with the first encryption key.
8. The memory system according to claim 1 , wherein
the controller is further configured to
validate a startup program when the memory system is powered on or restarted, and
when the startup program is validated, execute the startup program and determine whether or not the volatile memory maintains the first information and the verification value.
9. The memory system according to claim 1 , wherein
the user area is specified by a logical address of the non-volatile memory.
10. The memory system according to claim 9 , wherein
the nonvolatile memory includes a system area that stores a table that associates each of the user areas with a logical address of the non-volatile memory.
11. A method for booting a memory system configured to communicate with a host and having a nonvolatile memory, a volatile memory, and a battery, the method comprising:
upon startup of the memory system, determining whether or not first information indicating that an access to at least one of user areas in the nonvolatile memory is permitted and a verification value for validating the first information are maintained in the volatile memory;
when the first information and the verification value are maintained in the volatile memory,
determining whether or not the first information is validated by the verification value, and
upon determining that the first information is validated, permitting an access from the host to said at least one of the user areas and prohibiting the access to any user area other than said at least one of the user areas; and
when the first information and the verification value are not maintained in the volatile memory, or the first information and the verification value are maintained but the first information is not validated,
prohibiting an access from the host to any user area, and
thereafter, upon receipt of a command to request for an access to a user area and valid authentication information, permitting the access to the user area, generating first information indicating that the access to the user area is permitted and a verification value for validating the generated first information, and storing the generated first information and verification value in the volatile memory.
12. The method according to claim 11 , further comprising:
when the first information and the verification value are maintained in the volatile memory and the first information is validated, after permitting the access to said at least one of the user areas, acquiring a first encryption key to access said at least one of the user areas, and storing the acquired first encryption key in a register of an encryption circuit of the memory system.
13. The method according to claim 12 , further comprising:
when the first information and the verification value are not maintained, or the first information and the verification value are maintained but the first information is not validated, after permitting the access to the user area, acquiring a first encryption key to assess the user area, and storing the acquired first encryption key in the register.
14. The method according to claim 13 , wherein
the nonvolatile memory includes a system area that stores an encrypted first encryption key to access each user area, and
the method further comprises acquiring the first encryption key to access said at least one of the user areas or the user area specified by the command by decrypting a corresponding encrypted first encryption key.
15. The method according to claim 14 , wherein
the first information includes a random number and an encrypted second encryption key, and
when the volatile memory maintains the first information and the verification value and the first information is validated, the first encryption key is acquired by
generating a third encryption key using the random number,
decrypting the encrypted second encryption key with the third encryption key, and
decrypting the corresponding encrypted first encryption key stored in the system area with the second encryption key.
16. The method according to claim 14 , wherein
when the volatile memory does not maintain the first information and the verification value, or the volatile memory maintains the first information and the verification value but the first information is not validated, the first information is generated by
generating a second encryption key from the authentication information received from the host,
generating a third encryption key by using a random number,
encrypting the second encryption key with the third encryption key, and
generating the first information indicating that the access to the user area is permitted and including the random number and the encrypted second encryption key.
17. The method according to claim 12 , wherein
data to be written to the user area is encrypted by the encryption circuit using the first encryption key, and data read from the user area is decrypted using the first encryption key.
18. The method according to claim 11 , further comprising:
validating a startup program when the memory system is powered on or restarted, and
when the startup program is validated, executing the startup program and proceeding to the determination of whether or not the first information and the verification value are maintained in the volatile memory.
19. The method according to claim 11 , wherein
the user area is specified by a logical address.
20. The method according to claim 19 , wherein
the nonvolatile memory includes a system area that stores a table that associates each of the user areas with a logical address of the non-volatile memory.