DEVICE AND METHOD FOR SECURE DATA STORAGE

1 . A device for secure data storage, comprising:

a host unit configured to obtain data stored on an external device at an external storage address;

a user signal generator configured to generate a user defined security signal based on said external storage address of said data that indicates a security level of said data;

a storage address determining unit configured to determine an internal storage address for said data based on said security level of said data; and

a storage unit configured to store said data at said internal storage address corresponding to said security level.

2 . The device of claim 1 , wherein said user signal generator determines said security level of said data using a security level mapping rule between security levels and external storage addresses of data on external devices.

3 . The device of claim 1 , wherein said storage address determining unit determines said internal storage address for said data using an internal storage address mapping rule between security levels and internal storage addresses in said storage unit.

4 . The device of claim 3 , wherein different internal storage address mapping rules are used by said storage address determining unit to determine said internal storage address for data with different security levels.

5 . The device of claim 3 , wherein said storage address determining unit further comprises a memory management unit (MMU), and wherein if said security level of said data is equal to or higher than a predetermined security level, said MMU maps an initial internal storage address pre-assigned by said device for said data into said internal storage address of said data based on said internal storage address mapping rule.

6 . The device of claim 5 , wherein said MMU includes a translation look-aside buffer (TLB), and wherein if said security level of said data is equal to or higher than a predetermined security level, said TLB is used to map an initial internal storage address pre-assigned by said device for said data into said internal storage address of said data based on said internal storage address mapping rule.

7 . The device of claim 3 , wherein if said security level of said data is lower than a predetermined security level, said storage address determining unit uses an initial internal storage address pre-assigned by said device for said data as said internal storage address of said data according to said internal storage address mapping rule.

8 . The device of claim 1 , further comprising:

a secure processing unit that determines if a secure processing is required to be performed on said data according to a secure processing requirement of said data before said data is stored in said storage unit, and performs said secure processing on said data based on a result of said determination.

9 . The device of claim 8 , wherein said secure processing requirement is indicated by said user defined security signal.

10 . The device of claim 8 , wherein said secure processing requirement is determined based on said security level of said data.

11 . The device of claim 8 , wherein said secure processing includes encryption or decryption process.

12 . A method for secure data storage, comprising:

obtaining data stored on an external device at an external storage address;

generating a user defined security signal based on said external storage address of said data that indicates a security level of said data;

determining an internal storage address for said data based on said security level of said data; and

storing said data at said internal storage address corresponding to said security level.

13 . The method of claim 12 , further comprising:

determining said security level of said data using a security level mapping rule between security levels and external storage addresses of data on external devices.

14 . The method of claim 12 , wherein determining said internal storage address for said data based on said security level of said data comprises:

determining said internal storage address for said data using an internal storage address mapping rule between security levels and internal storage addresses of said storage unit.

15 . The method of claim 14 , wherein different internal storage address mapping rules are used to determine said internal storage address for data with different security levels.

16 . The method of claim 14 , wherein determining said internal storage address for said data using an internal storage address mapping rule between security levels and internal storage addresses of said storage unit comprises:

if said security level of said data is equal to or higher than a predetermined security level, using a memory management unit to map an initial internal storage address pre-assigned for said data into said internal storage address of said data based on said internal storage address mapping rule.

17 . The method of claim 14 , wherein determining said internal storage address for said data using an internal storage address mapping rule between security levels and internal storage addresses of said storage unit comprises:

if said security level of said data is equal to or higher than a predetermined security level, using a memory management unit with a translation look-aside buffer (TLB) to map an initial internal storage address pre-assigned for said data into said internal storage address of said data based on said internal storage address mapping rule.

18 . The method of claim 14 , wherein if said security level of said data is lower than a predetermined security level, using an initial internal storage address pre-assigned for said data as said internal storage address of said data according to said internal storage address mapping rule according to said internal storage address mapping rule.

19 . The method of claim 12 , further comprising:

determining if a secure processing is required to be executed on said data according to a secure processing requirement of said data before said data is stored, and

performing said secure processing on said data based on a result of said determination.

20 . The method of claim 19 , wherein said secure processing requirement is indicated by said user defined security signal, and determined based on said security level of said data.

21 . (canceled)

22 . (canceled)