Storage device for performing access authority control and operating method thereof
A storage device for performing an access authority control and an operating method thereof are disclosed. The storage device including processing circuitry configured to store a plurality of security information associated with the plurality of namespaces in response to a command from the host, each of the security information including virtual machine information associated with a corresponding one of the plurality of virtual machines and unique information associated with the corresponding virtual machine, the virtual machine information including an identifier for the corresponding virtual machine, and the unique information including unique information uniquely set for the corresponding virtual machine, extract at least first information by decoding a data access request received from the host device, and abort processing of the data access request based on the security information and the extracted at least one first information.
1. A storage device for communicating with a host device, the storage device comprising:
nonvolatile memory comprising a plurality of cell blocks, the plurality of cell blocks allocated into a plurality of namespaces, each of the plurality of namespaces associated with at least one virtual machine of a plurality of virtual machines generated by the host device; and
processing circuitry configured to,
store a plurality of security information associated with the plurality of namespaces in response to a command from the host device, each of the security information including virtual machine information associated with a corresponding one of the plurality of virtual machines and unique information associated with the corresponding virtual machine, the virtual machine information including an identifier for the corresponding virtual machine, and the unique information including, a memory address indicating a position of an input/output queue allocated to the corresponding virtual machine in host memory included in the host device,
extract at least first information by decoding a data access request received from the host device, and
abort processing of the data access request based on the virtual machine information, the unique information, and the extracted at least one first information.
2. The storage device of claim 1 , wherein
each of the virtual machine information includes a virtual machine identifier unique to the corresponding virtual machine; and
each of the unique information further includes a namespace identifier (ID) indicating a namespace associated with the corresponding virtual machine.
3. The storage device of claim 2 , wherein, in response to an additional virtual machine being generated by the host device, the processing circuitry is further configured to generate security information regarding the additional virtual machine.
4. The storage device of claim 1 , wherein the processing circuitry further includes a plurality of virtual functions corresponding to the plurality of virtual machines, and
each of the plurality of virtual functions is configured to,
store the security information associated with the corresponding virtual machine, and
determine access authority of the corresponding virtual machine based on the stored security information associated with the corresponding virtual machine in response to a data access request received from the corresponding virtual machine.
5. The storage device of claim 4 , wherein the plurality of virtual functions are configured to provide access to the virtual machines to the nonvolatile memory through a plurality of independent paths according to virtualization technology.
6. The storage device of claim 4 , wherein a first virtual function of the plurality of virtual functions is configured to:
receive, as the data access request, a read request from a first virtual machine of the plurality of virtual machines;
extract the first information included in the read request by decoding the read request; and
process the read request from the first virtual machine based on the first information included in the read request matching the unique information corresponding to the first virtual machine.
7. The storage device of claim 4 , wherein a first virtual function of the plurality of virtual functions is configured to:
receive, as the data access request, a read request from a second virtual machine of the plurality of virtual machines;
extract the first information included in the read request by decoding the read request; and
abort processing of the read request from the second virtual machine based on the first information included in the read request not matching the unique information corresponding to the second virtual machine.
8. The storage device of claim 1 , wherein
the nonvolatile memory comprises a plurality of flash memory chips;
each flash memory chip includes a subset of the plurality of cell blocks; and
each of the plurality of namespaces includes at least one cell block.
9. An operating method of a storage device for communicating with a host device, the storage device comprising a plurality of namespaces, and each namespace comprising at least one cell block, the operating method comprising:
receiving a setting command from the host device;
storing a plurality of security information, in response to the setting command, the plurality of security information including a plurality of virtual machine information associated with each virtual machine of a plurality of virtual machines, the virtual machines being generated by the host device, each of the virtual machine information including a memory address indicating a position in a host memory of an input/output queue associated with the associated virtual machine, and a namespace identifier (ID) indicating a namespace associated with the virtual machine; and
selectively aborting processing of a read request received from the host device based on the virtual machine information, the memory address indicating the position in the host memory of the input/output queue associated with the associated virtual machine, and information extracted from the read request.
10. The operating method of claim 9 , wherein the virtual machine information includes an indication for the associated virtual machine, and the memory address and the namespace ID are mapped to the respective virtual machine information.
11. The operating method of claim 10 , further comprising:
comparing the namespace ID corresponding to the virtual machine information extracted from the read request to additional information extracted from the read request.
12. The operating method of claim 9 , further comprising:
updating the plurality of security information with new virtual machine information regarding a new virtual machine generated by the host device, the virtual machine information including a memory address and a namespace ID corresponding to the new virtual machine, the memory address and the namespace ID mapped to the new virtual machine information.
13. The operating method of claim 9 , further comprising:
generating a plurality of virtual functions corresponding to the plurality of virtual machines in response to a request from the host device,
wherein the plurality of security information regarding the plurality of virtual machines are stored in the corresponding virtual function.
14. The operating method of claim 13 , wherein the selectively aborting the processing of the read request comprises:
decoding, by a first virtual function of the plurality of virtual functions, a read request received from a first virtual machine of the plurality of virtual machines, and extracting a memory address and a namespace ID from the read request; and
processing the read request from the first virtual machine based on the extracted information matching the memory address and the namespace ID mapped to the virtual machine information corresponding to the first virtual machine.
15. The operating method of claim 13 , wherein the selectively aborting the processing of the read request comprises:
decoding, by a first virtual function of the plurality of virtual functions, a read request received from a second virtual machine of the plurality of virtual machines, and extracting a memory address and a namespace identifier ID from the read request; and
aborting processing of the read request from the second virtual machine based on the extracted information not matching the memory address and the namespace ID mapped to the virtual machine information corresponding to the second virtual machine.
16. The operating method of claim 9 , wherein
the security information is stored in a volatile memory in the storage device; and
the receiving the setting command is performed when initially operating the storage device.
17. A host device for accessing a plurality of namespaces provided to a storage device, the host device comprising:
a host memory comprising a plurality of input/output queues allocated to at least one virtual machine of a plurality of virtual machines; and
processing circuitry configured to,
manage generation of the plurality of virtual machines and the allocation of the plurality of input/output queues in the host memory to the plurality of virtual machines, each of the virtual machines configured to generate a read request for accessing the plurality of namespaces through independent paths according to virtualization technology, and
transmit a setting command to a storage device, the setting command including a plurality of security information associated with the plurality of virtual machines, each of the plurality of security information including virtual machine information identifying the associated virtual machine, a memory address indicating a position of an input/output queue allocated to the associated virtual machine, and a namespace identifier (ID) indicating a namespace associated with the virtual machine.
18. The host device of claim 17 , wherein each of the virtual machine information identifying a single virtual machine, and the memory address and the namespace ID are mapped to an associated virtual machine information.
19. The host device of claim 17 , wherein
a first virtual machine of the plurality of virtual machines is associated with a first namespace of the storage device; and
in response to a second virtual machine of the plurality of virtual machines transmitting a read request to the storage device, the read request including the memory address corresponding to the first virtual machine or the namespace ID associated with the first namespace, completion of the read request from the second virtual machine is blocked.