Abstract: A data storage system can organize a semiconductor memory into a first data set and a second data set with a first queue populated with a first data access request from a host. An assignment of an arbitration weight to the first queue with an arbitration circuit corresponds with the first queue being skipped during a deterministic window based on the arbitration weight.

Abstract: Method and apparatus for protecting against a jitter attack upon a cryptographic processing device. In some embodiments, the cryptographic processing circuit is configured to perform a cryptographic function on a set of input data to generate a corresponding set of transformed output data. An input line supplies an input signal used by the cryptographic processing IC during execution of the cryptographic function. A monitor circuit monitors the input signal, and temporarily disables the cryptographic processing IC when time-varying changes to the input signal indicate a jitter attack may be taking place. The input signal may be a source voltage, and voltage transitions in the source voltage can be monitored. Alternatively, the input signal may be a clock signal, and frequency variations in the clock signal can be monitored. The monitor circuit may be arranged on a power island to maintain power during power fluctuations.

Abstract: Method and apparatus for managing data transfers. In some embodiments, first and second storage devices respectively include first and second controllers, first and second local memories, and first and second non-volatile memories (NVMs). A virtual controller memory buffer (CMB) is formed from a dedicated portion of each of the first and second local memories for control by a host device. The first controller receives a virtual command set from the host device, and extracts a first local command to transfer data between the host device and the first NVM. In some cases, the second controller also receives the virtual command set and concurrently extracts a different, second local command to transfer data between the host device and the second NVM. Alternatively, the first controller may extract and forward the second local command to the second controller. The first and second NVMs may form an NVMe (Non-Volatile Memory Express) namespace.

Abstract: Method and apparatus for deterministically arbitrating a shared resource in a system, such as a solid-state drive (SSD) operated in accordance with the NVMe (Non-Volatile Memory Express) specification. An NVM, such as a flash memory, is coupled to a controller circuit for concurrent servicing of data transfer commands from multiple users along parallel data paths that include a shared resource. A time cycle during which the shared resource can be used is divided into a sequence of time-slices, each assigned to a different user. The shared resource is thereafter repetitively allocated over a succession of time cycles to each of the users in turn during the associated time-slices. If a selected time-slice goes unused by the associated user, the shared resource remains unused rather than being used by a different user, even if a pending request for the shared resource has been issued.

Abstract: Method and apparatus for managing data transfers. In some embodiments, first and second storage devices respectively include first and second controllers, first and second local memories, and first and second non-volatile memories (NVMs). A virtual controller memory buffer (CMB) is formed from a dedicated portion of each of the first and second local memories for control by a host device. The first controller receives a virtual command set from the host device, and extracts a first local command to transfer data between the host device and the first NVM. In some cases, the second controller also receives the virtual command set and concurrently extracts a different, second local command to transfer data between the host device and the second NVM. Alternatively, the first controller may extract and forward the second local command to the second controller. The first and second NVMs may form an NVMe (Non-Volatile Memory Express) namespace.

Abstract: Method and apparatus for managing data in a data storage device configured as a storage compute appliance. In some embodiments, the data storage device has a non-volatile memory (NVM) and a controller circuit. The NVM stores a plurality of data sets encrypted by at least one encryption key. The controller circuit performs a storage compute appliance process by locally decrypting the plurality of data sets in a local memory of the data storage device, generating summary results data from the decrypted data sets, and transferring the summary results data across the host interface to an authorized user without a corresponding transfer of any portion of the decrypted data sets across the host interface.

Abstract: Method and apparatus for managing data in a data storage device configured as a storage compute appliance. In some embodiments, the data storage device has a controller circuit and a non-volatile memory (NVM) with an overall data storage capacity. A processor authenticates each of a plurality of authorized users of the NVM via data exchanges between a host device and the processor without reference to an external authentication authority device. Upon authentication, each authorized user is allocated a separate portion of the overall data storage capacity of the NVM using an allocation model. The size of at least one of the separate portions is subsequently adjusted based on an access history of the NVM. The storage device may be a key-value storage device so that a separate set of key values is provided to each authorized user to identify data blocks stored to and retrieved from the NVM.

Abstract: A data storage system can organize a semiconductor memory into a first data set and a second data set with a first queue populated with a first data access request from a host. An assignment of an arbitration weight to the first queue with an arbitration circuit corresponds with the first queue being skipped during a deterministic window based on the arbitration weight.

Abstract: Systems and methods are disclosed for enhanced garbage collection operations at a memory device. The enhanced garbage collection may include selecting data and blocks to garbage collect to improve device performance. Data may be copied and reorganized according to a data stream via which the data was received, or data and blocks may be evaluated for garbage collection based on other access efficiency metrics. Data may be selected for collection based on sequentiality of the data, host access patterns, or other factors. Processing of host commands may be throttled based on a determined amount of work to garbage collect a plurality of blocks, in order to limit variability in host command throughput over a time period.

Abstract: Method and apparatus for protecting against a jitter attack upon a cryptographic processing device. In some embodiments, the cryptographic processing circuit is configured to perform a cryptographic function on a set of input data to generate a corresponding set of transformed output data. An input line supplies an input signal used by the cryptographic processing IC during execution of the cryptographic function. A monitor circuit monitors the input signal, and temporarily disables the cryptographic processing IC when time-varying changes to the input signal indicate a jitter attack may be taking place. The input signal may be a source voltage, and voltage transitions in the source voltage can be monitored. Alternatively, the input signal may be a clock signal, and frequency variations in the clock signal can be monitored. The monitor circuit may be arranged on a power island to maintain power during power fluctuations.

Abstract: Method and apparatus for managing data in a data storage device configured as a storage compute appliance. In some embodiments, the data storage device has a controller circuit and a non-volatile memory (NVM) with an overall data storage capacity. A processor authenticates each of a plurality of authorized users of the NVM via data exchanges between a host device and the processor without reference to an external authentication authority device. Upon authentication, each authorized user is allocated a separate portion of the overall data storage capacity of the NVM using an allocation model. The size of at least one of the separate portions is subsequently adjusted based on an access history of the NVM. The storage device may be a key-value storage device so that a separate set of key values is provided to each authorized user to identify data blocks stored to and retrieved from the NVM.

Abstract: Method and apparatus for managing data in a data storage device configured as a storage compute appliance. In some embodiments, the data storage device has a non-volatile memory (NVM) and a controller circuit. The NVM stores a plurality of data sets encrypted by at least one encryption key. The controller circuit performs a storage compute appliance process by locally decrypting the plurality of data sets in a local memory of the data storage device, generating summary results data from the decrypted data sets, and transferring the summary results data across the host interface to an authorized user without a corresponding transfer of any portion of the decrypted data sets across the host interface.

Abstract: Systems and methods presented herein provide for data storage for a plurality of host systems. In one embodiment, a storage system comprises a storage unit, and a controller. The controller is operable to process a write I/O request from a first of the host systems, to determine an identity of the first host system from the write I/O request, to encrypt data of the write I/O request based on the identity of the first host system, to locate a storage space allocated to the first host system in the storage unit, to determine that a size of the data of the write I/O request requires more storage space than currently allocated to the first host system, to increase the storage space allocated to the first host system by the size of the data of the write I/O request, and to write the encrypted data to the storage unit.

Abstract: An apparatus comprises at least one port for coupling signals to the apparatus, a mode selector for setting the apparatus to a normal mode or a debug mode, and a port control for controlling access to secure information in the apparatus through the port in accordance with the selected mode. A method for controlling access to the port is also provided.

Abstract: A data storage system comprises a storage element, and an encryption and decryption unit connected between a host and the storage element, and using a key that is generated in the data storage system.