Storage device, storage control method, computer program product, and storage system

This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2017-175901, filed on Sep. 13, 2017; the entire contents of which are incorporated herein by reference.

Embodiments described herein relate generally to a storage device, a storage control method, a computer program product, and a storage system.

Techniques relating to data preservation have been known. For example, a system, which acquires a digest of data and checks whether the data matches data held in a terminal, has been known. In addition, a system, which erases a file from a storage device when an erase keyword coinciding with a keyword assigned to a file is input, has been known.

Conventionally, however, there is a case where erroneous erasing or erroneous updating of data is performed due to vulnerability of a program operating on a host processor. Thus, conventionally, it is sometimes difficult to preserve data of the storage device.

FIG. 1 is a schematic diagram of a storage system;

FIG. 2 is a schematic diagram illustrating a functional configuration of the storage system;

FIGS. 3A and 3B are schematic diagrams of data configurations of a data storage unit and a management information storage unit;

FIG. 4 is a schematic diagram of data configurations of rewrite management and erase management;

FIG. 5 is a schematic diagram of data configurations of a share code management DB, a first transmission management DB, and a second transmission management DB;

FIG. 6 is a schematic diagram of data configurations of a written-information management DB and a correspondence relationship management DB;

FIG. 7 is a schematic diagram of data configurations of a share code management DB, a third transmission management DB, and a fourth transmission management DB;

FIG. 8 is a flowchart of a procedure of a write process;

FIG. 9 is a flowchart of a procedure of a transmission process;

FIG. 10 is a flowchart of a procedure of a read process;

FIG. 11 is a flowchart of a procedure of a reception process;

FIG. 12 is a flowchart of a procedure of an erase process;

FIG. 13 is a flowchart of a procedure of information processing; and

FIG. 14 is a hardware configuration diagram of a storage device.

According to an embodiment, a storage device includes an acquisition unit, a first generation unit, and an erase unit. The acquisition unit is configured to acquire erase permission notification which is generated based on specific data and first authentication information to authenticate the specific data, and includes a first erase code to erase the specific data and physical area information indicating a physical area of the specific data. The first generation unit is configured to generate a second erase code using the specific data stored in the physical area indicated by the physical area information and the first authentication information. The erase unit is configured to erase data stored in the physical area indicated by the physical area information when the first erase code corresponds to the second erase code.

Hereinafter, a storage device, a storage control method, a computer program product, and a storage system will be described in detail with reference to the accompanying drawings.

FIG. 1 is a schematic diagram illustrating an example of a storage system 1 according to the present embodiment.

The storage system 1 includes a server device 20 and a storage device 10 . In the present embodiment, the storage device 10 is mounted on a vehicle 2 . Thus, the storage system 1 includes the server device 20 and the vehicle 2 in the present embodiment.

Incidentally, the storage device 10 is not limited to the mode of being mounted on the vehicle 2 . For example, the storage device 10 may be mounted on a moving body other than the vehicle 2 or a non-moving body.

The vehicle 2 and the server device 20 communicate with the server device 20 via a base station 3 and a network 4 . That is, the storage device 10 and the server device 20 are connected to be capable of communicating with each other. The base station 3 relays the vehicle 2 and the server device 20 via the network 4 .

The network 4 is a known communication line. The network 4 may be a wired communication network or a wireless communication network. The network 4 is, for example, a local area network (LAN) or the Internet. In the present embodiment, a case where the network 4 is a communication network for wireless communication will be described as an example.

The vehicle 2 includes the storage device 10 . In the present embodiment, the vehicle 2 includes the storage device 10 , an electronic control unit (ECU) 12 , a host processor 14 , a network interface controller 16 , and a memory 18 .

The storage device 10 , the network interface controller 16 , the memory 18 , and the host processor 14 are connected, via a bus, to be capable of communicating with each other. The bus is, for example, PCI Express® or the like.

The ECU 12 is mounted on the vehicle 2 and executes a function as an electronic device to control the vehicle 2 . The ECU 12 and the host processor 14 are connected via a network such as a controller area network (CAN) and an in-vehicle Ethernet®. A CAN controller, an in-vehicle Ethernet controller, or the like is used for connection although not illustrated. The ECU 12 outputs data such as data used for control of the vehicle 2 and a log indicating a control result to the host processor 14 .

The host processor 14 controls writing of data to the storage device 10 , reading of data, and communication with the server device 20 . For example, the host processor 14 outputs an instruction to write data output from the ECU 12 to the storage device 10 .

The network interface controller 16 communicates with the server device 20 via the network 4 . A communication method of the network interface controller 16 is not limited. For example, the communication method is a wireless communication method such as LTE, and 5G. In addition, wireless communication may be performed via an in-vehicle network.

The storage device 10 stores various types of data. The storage device 10 stores data output from the ECU 12 in the present embodiment. Incidentally, the data stored in the storage device 10 is not limited to the data output from the ECU 12

The storage device 10 is realized by, for example, a storage element such as a NAND flash memory. The storage device 10 is, for example, a solid state drive (SSD), an embedded multi-media card (eMMC), a secure digital (SD) card.

The server device 20 manages data stored in the storage device 10 . In the present embodiment, the server device 20 includes a storage device 22 , a host processor 24 , a memory 28 , and a network interface controller 26

The storage device 22 , the network interface controller 26 , the memory 28 , and the host processor 24 are connected via a bus to be capable of communicating with each other.

The host processor 24 controls writing of data to the storage device 22 , reading of data, and communication with the vehicle 2 .

The network interface controller 26 communicates with the vehicle 2 via the network 4 . A communication method of the network interface controller 26 is not limited.

The storage device 22 of the server device 20 stores various types of data. The storage device 22 is realized by, for example, a storage element such as a NAND flash memory. The storage device 22 is, for example, an SSD. In addition, a hard disk drive (HDD) may also be used.

Next, a functional configuration of the storage system 1 will be described. FIG. 2 is a schematic diagram illustrating an example of the functional configuration of the storage system 1 .

Functional Configuration of Vehicle 2

First, a functional configuration of the vehicle 2 will be described.

The vehicle 2 includes the ECU 12 , the host processor 14 , the network interface controller 16 , and the storage device 10 .

The network interface controller 16 includes a communication unit 16 A. The communication unit 16 A communicates with the server device 20 .

The ECU 12 includes a data generation unit 12 A. The data generation unit 12 A generates data such as data used for control of the vehicle 2 and a log indicating a control result. The data generation unit 12 A outputs the generated data to the host processor 14 . These pieces of data are used, for example, to analyse an operation status and a cause of failure of the storage device 10 .

The host processor 14 includes a write instruction unit 14 A, a read instruction unit 14 E, a transmission unit 14 C, and a reception unit 14 D.

Whenever receiving data from the data generation unit 1 A, the write instruction unit 14 A outputs a write instruction of the received data to the storage device 10 . The write instruction includes, for example, an address of a write destination of the storage device 10 , a head address of data received from the ECU 12 stored on the memory 18 (see FIG. 1 ), a data length of the data as a write target, and the like

The read instruction unit 14 B outputs a read instruction of data, stored in a physical area (to be described later in detail) of the storage device 10 , to the storage device 10 . The read instruction includes, for example, an address of a read source of the storage device 10 , a head address on the memory 18 in which the read data is written, a data length of the data as a read target, and the like.

The transmission unit 14 C receives written information and correspondence relationship update information from the storage device 10 . The transmission unit 14 C transmits the received written information and correspondence relationship update information to the server device 20 via the communication unit 16 A.

The written information is information configured to notify the server device 20 of newly written data in a physical area of a data storage unit 30 A. The correspondence relationship update information is information configured to notify the server device 20 of an update of a correspondence relationship management DB 30 E. Details of the written information and the correspondence relationship update information will be described later.

The reception unit 14 D receives erase permission notification or rewrite permission notification from the server device 20 via the communication unit 16 A. The reception unit 14 D outputs the erase permission notification and the rewrite permission notification to the storage device 10 .

The erase permission notification is information configured to notify permission to erase data stored in a specific physical area of the data storage unit 30 A. The rewrite permission notification is information configured to notify permission to rewrite logical area information of the correspondence relationship management DB 30 E. Details of the erase permission notification and the rewrite permission notification will be described later.

Next, the functional configuration of the storage device 10 will be described. The storage device 10 includes an acquisition unit 10 A, a first generation unit 10 B, a change unit 10 C, an erase unit 10 D, a read unit 10 E, a write unit 10 F, a correspondence relationship output unit 10 G, a first transmission unit 10 H, and a storage unit 30 . The storage unit 30 includes the data storage unit 30 A, a management information storage unit 30 B, a permission area information storage unit 30 C, and an authentication information storage unit 30 D.

At least one of the acquisition unit 10 A, the first generation unit 10 B, the change unit 10 C, the erase unit 10 D, the read unit 10 E, the write unit 10 F, the correspondence relationship output unit 10 G, the first transmission unit 10 H, the management information storage unit 30 B, the permission area information storage unit 30 C, and the authentication information storage unit 30 D is realised by, for example, one or a plurality of processors. For example, each of the above-described units may be realized by causing a processor such as a central processing unit (CPU) to execute a program, that is, by software. Each of the above-described units may be realized by hardware such as a dedicated application specific integrated circuit (ASIC). Each of the above-described units may be realized by using software and hardware in combination. In the case of using a plurality of processors, each processor may realize one of the respective units or may realize two or more of the respective units.

The storage unit 30 stores various types of data. As described above, the storage unit 30 includes the data storage unit 30 A, the management information storage unit 30 B, the permission area information storage unit 30 C, and the authentication information storage unit 30 D.

In the present embodiment, the data storage unit 30 A is a flash memory (non-volatile memory). The data storage unit 30 A is, for example, a NAND flash memory. In the present embodiment, a case where the data storage unit 30 A is the NAND flash memory will be described as an example.

The management information storage unit 30 B, the permission area information storage unit 30 C, and the authentication information storage unit 30 D may be volatile memories or non-volatile memories. In the case of using the volatile memory, it is possible to operate the volatile memory as a cache while synchronizing with data with the non-volatile memory.

Incidentally, an example in which the data storage unit 30 A, the management information storage unit 30 B, the permission area information storage unit 30 C, and the authentication information storage unit 30 D are configured as separate storage units has been described in the present embodiment. However, at least two or more of the data storage unit 30 A, the management information storage unit 30 B, the permission area information storage unit 30 C, and the authentication information storage unit 30 D may be configured as one storage unit.

The data storage unit 30 A stores data. In the present embodiment, the data storage unit 30 A stores the data received from the ECU 12 . Specifically, the management information storage unit 30 B stores the correspondence relationship management DB 30 E and a physical area management DB 30 F.

FIGS. 3A and 3B are schematic diagrams illustrating exemplary data configurations of the data storage unit 30 A and the management information storage unit 30 B.

FIG. 3A is the schematic diagram illustrating the exemplary data configuration of the data storage unit 30 A. As described above, the data storage unit 30 A is the NAND flash memory in the present embodiment. Thus, the data storage unit 30 A is managed for each physical page and each physical block. The physical page is a unit of reading and writing. A physical block is a unit of erasing.

FIG. 3B is the schematic diagram illustrating the exemplary data configurations of the correspondence relationship management DB 30 E and the physical area management DB 30 F.

The correspondence relationship management DB 30 E is a database that indicates a correspondence relationship between physical area information and logical area information. The correspondence relationship indicates a one-to-one relationship between logical area information and physical area information corresponding to the logical area information. That is, the correspondence relationship management DB 30 E is a database in which one or a plurality of one-to-one correspondence relationships between the physical area information and the logical area information is registered. Incidentally, a data format of the correspondence relationship management DB 30 E is not limited to the database.

The physical area information is information indicating a physical area in which data is stored in the data storage unit 30 A. The physical area is, for example, the physical block or the physical page. The physical area information may be information configured to identify the physical area. For example, the physical area information is identification information of the physical block or the physical page. Specifically, the physical area information is a physical block number or a physical page number. Incidentally, the physical block number is also referred to as a physical block address in some cases. In addition, the physical page number is also referred to as a physical page address in some cases.

In the present embodiment, a case where the physical area indicates the physical block and the physical area information indicates the physical block number will be described as an example.

The logical area information is a serial number allocated for each access unit with respect to the data storage unit 30 A. The logical area information is, for example, a logical block number or a logical page number. Incidentally, the logical block number is also referred to as a logical block address in some cases. In addition, the logical page number is also referred to as a logical page address in some cases.

In the present embodiment, a case where the logical area information indicates the logical block number will be described as an example.

Here, when writing data to the NAND flash memory, it is difficult to perform overwrite in an area where data has been written, and thus, it is necessary to perform a process of erasing stored data in units of blocks and then newly writing data in an erased area. Thus, the data storage unit 30 A is configured using the NAND flash memory having a larger capacity than the capacity storable as the storage device 10 . When writing data, it is necessary to update physical area information corresponding to logical area information in the correspondence relationship management DB 30 E to physical area information of a physical area in which the data has been newly written. Thus, the correspondence relationship management DB 30 E is appropriately updated by a functional unit (to be described later) of the storage device 10 .

Next, the physical area management DB 30 F will be described. The physical area management DB 30 F is a database configured to manage a state of a physical area. In the present embodiment, the physical area management DB 30 F is a database in which physical area information, an erase count, and a status are associated with each other. Incidentally, a data format of the physical area management DA 30 F is not limited to the database.

The erase count is the number of times of erasing data stored in the physical area indicated by the corresponding physical area information. The erase count is used for wear-leveling and the like.

The status indicates a status e physical area indicated by the corresponding physical area information. The status is represented by any one of “in use”, “wait for erase”, “erased”, and “invalid”.

The status “in use” indicates a state where the corresponding physical area information is associated with logical area information in the correspondence relationship management DB 30 E. In other words, the status “in use” indicates that the corresponding physical area information is in use.

The status “wait for erase” indicates that the data of the physical area indicated by the corresponding physical area information is the erase target. In other words, the status “wait for erase” indicates that the physical area indicated by the corresponding physical area information is in a state of waiting for erase of data.

The status “erased” indicates that the data in the physical area indicated by the corresponding physical area information has been erased. In other words, the status “erased” indicates that the physical area indicated by the corresponding physical area information is in a state where new data can be written therein.

The status “invalid” indicates that the physical area indicated by the corresponding physical area information is invalid. Thus, the physical area indicated by the physical area information corresponding to the status “invalid” is excluded from write targets of new data.

The physical area management DB 30 F is updated by a process to be described later of the storage device 10 .

The description will continue returning to FIG. 2 . Next, the permission area information storage unit 30 C will be described. The permission area information storage unit 30 C stores information configured to manage rewrite permission and erase permission relating to a physical area. In the present embodiment, the permission area information storage unit 30 C stores a rewrite management DB 30 G and an erase management DB 30 H.

FIG. 4 is a schematic diagram illustrating exemplary data configurations of the rewrite management DB 30 G and the erase management DB 30 H.

The rewrite management DB 30 G is a database configured to manage whether to permit rewriting of physical area information corresponding to logical area information in the correspondence relationship management DB 30 E (see FIG. 3B ). Incidentally, a data format of the rewrite management DB 30 G is not limited to the database.

In the present embodiment, the rewrite management DB 30 G is a database in which logical area information and rewrite possibility information are associated with each other.

The rewrite possibility information is information indicating whether to permit rewriting of physical area information in the correspondence relationship illustrated in the correspondence relationship management DB 30 E. In other words, the rewrite possibility information is information indicating whether to permit rewriting of physical area information which corresponds to the corresponding logical area information. The rewrite possibility information indicates rewrite permission or rewrite prohibition.

The “rewrite permission” indicates to permit rewriting of the physical area information associated with the corresponding logical area information. That is, the physical area information in the correspondence relationship management DB 30 E, which is associated with the logical area information corresponding to the rewrite possibility information “rewrite permission” in the rewrite management DB 30 G, indicates a state where rewriting is permitted.

The “rewrite prohibition” indicates to prohibit rewriting of the physical area information associated with the corresponding logical area information. That is, the physical area information in the correspondence relationship management DB 30 E, which is associated with the logical area information corresponding to the rewrite possibility information “rewrite permission” in the rewrite management DB 30 G, indicates a state where rewriting is prohibited.

The rewrite management DB 30 G is updated by a process to be described later of the storage device 10 .

The erase management DB 30 H is a database configured to manage whether to permit erasing of data in the physical area indicated by the physical area information. Incidentally, a data format of the erase management DR 30 H is not limited to the database.

In the present embodiment, the erase management DB 30 H is a database in which physical area information and erase possibility information are associated with each other.

The erase possibility information is information indicating whether to permit erasing of data in the physical area indicated by the corresponding physical area information. The erase possibility information indicates erase permission or erase prohibition.

The “erase permission” indicates to permit erasing of data in the physical area indicated by the corresponding physical area information. The “erase prohibition” indicates to prohibit erasing of data in the physical area indicated by the corresponding physical area information.

The erase management DB 30 H is updated by a process to be described later of the storage device 10 .

The description will continue returning to FIG. 2 . Next, the authentication information storage unit 30 D will be described. The authentication information storage unit 30 D stores first authentication information and second authentication information.

The first authentication information includes at least one of a transmission count of written information to the server device 20 and a share code assigned in advance to the storage device 10 . The second authentication information includes at least one of a transmission count of rewritten information to the server device 20 and a share code assigned in advance to the storage device 10 . These pieces of authentication information will be described later in detail.

Specifically, the authentication information storage unit 30 D stores a share code management DB 30 I, a first transmission management DB 30 J, and a second transmission management DB 30 K in the present embodiment.

FIG. 5 is a schematic diagram illustrating exemplary data configurations of the share code management DB 30 I, the first transmission management DB 30 J, and the second transmission management DB 30 K.

The share code management DB 30 I is a database configured to manage a share code. Incidentally, a data format of the share code management DB 30 I is not limited to the database. The share code management DB 30 I manages a storage ID, a share code, and a uniform resource identifier (URI) of data transmission in association with each other.

The storage ID is identification information of the storage device 10 . The storage ID is constituted by, for example, a vendor ID and a manufacturing number.

The share code is a code shared when performing authentication processing with the server device 20 . The share code is, for example, a shared key or a secret key.

The URI for data transmission indicates a destination to which the storage device 10 transmits various types of data such as written information, and correspondence relationship update information. In the present embodiment, the URI of data transmission indicates a destination of the server device 20 . The destination may be, for example, mail address.

The share code management DB 30 I is stored in advance in the authentication information storage unit 30 D, for example, at the time of manufacturing the storage device 10 .

The first transmission management DB 30 J manages information relating to transmission of written information from the storage device 10 to the server device 20 . In the present embodiment, the first transmission management DB 30 J is a database in which physical area information and a transmission count are associated with each other. Incidentally, a data format of the first transmission management DB 30 J is not limited to the database.

The “transmission count” in the first transmission management DB 30 J indicates the number of times of transmission of the written information including the corresponding physical area information to the server device 20 .

The first transmission management DB 30 J is updated by a process to be described later of the storage device 10 .

The second transmission management DB 30 K manages information relating to transmission of correspondence relationship information from the storage device 10 to the server device 20 . In the present embodiment, the second transmission management DB 30 K is a database in which logical area information and a transmission count are associated with each other. Incidentally, a data format of the second transmission management DB 30 K is not limited to the database.

The “transmission count” in the second transmission management DB 30 K indicates the number of times of transmission of the correspondence relationship information including the corresponding logical area information to the server device 20 .

The second transmission management DB 30 K is updated by a process to be described later of the storage device 10 .

The description will continue returning to FIG. 2 .

The write unit 10 F receives the write instruction from the write instruction unit 14 A of the host processor 14 . Then, the write unit 10 F executes a process of writing data to the data storage unit 30 A based on the received write instruction.

In detail, the write unit 10 F executes a write process of writing data as a write target indicated by the write instruction into the data storage unit 30 A. As described above, the write instruction includes, for example, the address of the storage device 10 as the write destination, the head address of the data on the memory 18 , the data length of the data as the write target, and the like. The data on the memory 18 is the data as the write target.

First, the write unit 10 F calculates logical area information corresponding to the address of the storage device 10 as the write destination included in the write instruction. Then, the write unit 10 F determines whether physical area information corresponding to the calculated logical area information in the correspondence relationship management DB 30 E (see FIG. 3B ) is rewritable.

In detail, the write unit 10 F determines whether the rewrite possibility information corresponding to the calculated logical area information in the rewrite management DB 30 G indicates “rewrite permission”. With this determination, the write unit 10 F determines whether the physical area information corresponding to the logical area information in the correspondence relationship management DB 30 E is rewritable.

Then, when it is determined that the physical area information is rewritable, the write unit 10 F determines whether there is an “erased” physical area. The write unit 10 F performs this determination by determining whether the physical area information associated with the status “erased” is registered in the physical area management DB 30 F (see FIG. 3B ).

When it is determined that there is a physical area with the status “erased”, the write unit 10 F selects one physical area information associated with the status “erased” from the physical area management DB 30 F. Then, the write unit 10 F writes the write target data in a physical area indicated by the selected physical area information in e data storage unit 30 A.

In this manner, when the rewrite possibility information of the physical area information corresponding to the logical area information of the write target data indicates the rewrite permission, the write unit 10 F writes this data in the physical area of the physical area information.

At this time, there are a case where writing normally ends and a case where writing abnormally ends. For example, when writing data, the write unit 10 F reads the written data once, compares the written data with data before being written, and determines whether both pieces of data match each other. Then, when it is determined that the both pieces of data match each other, the write unit 10 F determines that the writing has normally ended. On the other hand, when a state of mismatch has occurred a predetermined number of times or more, the write unit 10 F determines that the writing has abnormally ended.

When the writing has abnormally ended, the write unit 10 F sets a status, which corresponds to the physical area information of the physical area in which the writing has abnormally ended in the physical area management DB 30 F (see FIG. 3B ), to “invalid”. Thus, the physical area in which the writing has abnormally ended is not subject to subsequent writing.

When the writing is normally ended, the write unit 10 F changes the status corresponding to the physical area information of the physical area in which data has been written in the physical area management DB 30 F (see FIG. 3B ) to “in use”.

Then, the write unit 10 F rewrites the physical area information corresponding to the logical area information used to write the data in the correspondence relationship management DB 30 E (see FIG. 3B ) with the physical area information of the physical area in which the data has been written.

That is, the write unit 10 F rewrites the physical area information corresponding to the logical area information used to write the data in the correspondence relationship between the logical area information and the physical area information registered in the correspondence relationship management DB 30 E with the physical area information of the physical area in which the data has been written.

Then, the write unit 10 F sets the erase possibility information corresponding to the physical area information of the physical area in which the data has been written in the erase management DB 30 H (see FIG. 4 ) to “erase prohibition”. In addition, the write unit 10 F sets the rewrite possibility information corresponding to the logical area information used to write the data in the rewrite management DB 30 G to “rewrite prohibition”.

Then, the write unit 10 F sets the status of the physical area information, associated with the logical area information used for the current writing of data in previous time (before the current writing), in the physical area management DB 30 F (see FIG. 3B ) to “wait for erase”.

Then, the write unit 10 F notifies the first transmission unit 10 H of an instruction to transmit the written information and the correspondence relationship update information. The transmission instruction includes, for example, physical area information of the physical area in which data has been written, the logical area information corresponding to the physical area information, the written data, and the like.

In addition, the write unit 10 F notifies the write instruction unit 14 A of the host processor 14 of write completion.

As described above, the write unit 10 F executes the write process. With this write process, when the rewrite possibility information of the physical area information corresponding to the logical area information of the write target data indicates the rewrite permission, the write unit 10 F writes this data in the physical area of the physical area information. In addition, the write unit 10 F rewrites the physical area information corresponding to the logical area information in the correspondence relationship with the physical area information of the physical area in which the data has been written.

When receiving the transmission instruction from the write unit 10 F, the first transmission unit 10 H executes a transmission process. The transmission process is a process of transmitting the written information and the correspondence relationship update information to the server device 20 . The first transmission unit 10 H transmits the written information and the correspondence relationship update information to the server device 20 via the transmission unit 14 C and the communication unit 16 A.

The written information is information configured to notify the server device 20 of newly written data in a physical area of a data storage unit 30 A. The written information includes a storage ID, physical area information, a transmission count of the written information, and data written in a physical area indicated by the physical area information. Incidentally, if a storage ID is included in first written information in a case where the first transmission unit 10 H performs transmission to the server device 20 using the same connection, written information to be subsequently transmitted does not necessarily include a storage ID. In addition, written information does not necessarily include a storage ID even when the storage ID can be specified by a URI. In addition, the written information may further include a write time or a transmission time.

Specifically, the first transmission unit 10 H reads physical area information and data written in a physical area indicated by the physical area information from the transmission instruction received from the write unit 10 F.

Incidentally, the first transmission unit 10 H may read the physical area information corresponding to the logical area information included in the transmission instruction from the correspondence relationship management DB 30 E via the read unit 10 E.

The read unit 10 E reads various types of information from the data storage unit 30 A and the management information storage unit 30 B. For example, the read unit 10 E performs reading of data stored in each physical area of the data storage unit 30 A, reading of correspondence relationship (the correspondence relationship management DB 30 E) stored in the management information storage unit 30 B and the physical area management DB 30 F, and the like.

For example, the first transmission unit 10 H outputs a read instruction including logical area information included in the transmission instruction to the read unit 10 E. The read unit 10 E reads physical area information corresponding to the logical area information included in the received read instruction from the correspondence relationship management DB 30 E (see FIG. 3B ). Then, the read unit 10 E outputs the received logical area information and the read physical area information to the first transmission unit 10 H as a correspondence relationship. The first transmission unit 10 H may acquire physical area information to be included in written information by reading the physical area information indicated by the correspondence relationship.

In addition, the first transmission unit 10 H may read data that has been currently written in the physical area from the data storage unit 30 A via the read unit 10 E. In this case, the read unit 10 E reads physical area information corresponding to the logical area information included in the received read instruction from the correspondence relationship management DB 30 E (see FIG. 3B ) in the same manner as described above. Then, the read unit 10 E reads the data of a physical area indicated by the read physical area information from the data storage unit 30 A and outputs the read data to the first transmission unit 10 H. As a result, the first transmission unit 10 H may read the data written in the physical area.

In addition, the first transmission unit 10 H reads the storage ID of the storage device 10 and the transmission count of the written information from the authentication information storage unit 30 D. In detail, the first transmission unit 10 H reads a transmission count, which corresponds to the physical area information of the physical area in which the data has been currently written, from the first transmission management DB 30 J (see FIG. 5 ) of the authentication information storage unit 30 D. In addition, the first transmission unit 10 H reads the storage ID from the share code management Db 30 I of the authentication information storage unit 30 D.

Then, the first transmission unit 10 H transmits the written information, which includes the storage ID, the physical area information, the transmission count of the written information, and the data written in the physical area indicated by the physical area information, to the server device 20 via the transmission unit 14 C and the communication unit 16 A.

A data format of the written information is not limited. The data format of the written information is, for example, extensible markup language (XML), JavaScript object notation (JSON)®, or the like. In addition, for example, hyper-text transfer protocol (HTTP) is used as a data transfer method. The first transmission unit 10 H may transmit the written information to a destination indicated by the URI of the data transmission stored in the authentication information storage unit 30 D. With this process, the first transmission unit 10 H transmits the written information to the server device 20 . Incidentally, the vehicle 2 and the server device 20 may perform HTTP connection whenever performing communication or may keep the HTTP connection.

When transmitting written information, the first transmission unit 10 H increases a transmission count corresponding to physical area information included in the written information by “1” in the first transmission management DB 30 J.

Next, the transmission of the correspondence relationship update information will be described.

The correspondence relationship update information is information configured to notify the server device 20 of the update of the correspondence relationship management DB 30 E rewritten by the write unit 10 F. The correspondence relationship update information includes a storage ID, logical area information, a transmission count of the correspondence relationship update information, and physical area information corresponding to the logical area information.

Incidentally, if a storage ID is included in first written information in a case where the first transmission unit 10 H performs transmission the server device 20 using the same connection, correspondence relationship update information to be subsequently transmitted does not necessarily include a storage ID. In addition, written information does not necessarily include a storage ID even when the storage ID can be specified by a URI. In addition, the correspondence relationship update information may further include a write time or a transmission time.

The first transmission unit 10 H reads the logical area information from the transmission instruction received from the write unit 10 F. In addition, the first transmission unit 10 H reads the transmission count and the storage ID of the correspondence relationship update information from the authentication information storage unit 30 D. In detail, the first transmission unit 10 H reads a transmission count corresponding to the logical area information included in the transmission instruction, from the second transmission management DB 30 K of the authentication information storage unit 30 D. In addition, the first transmission unit 10 H reads the storage ID from the share code management DB 30 I of the authentication information storage unit 30 D.

Then, the first transmission unit 10 H transmits the correspondence relationship update information, which includes the storage ID, the logical area information, the transmission count of the correspondence relationship update information, and the physical area information corresponding to the logical area information, to the server device 20 via the transmission unit 14 C and the communication unit 16 A.

A data format of the correspondence relationship update information is not limited. The data format of the correspondence relationship update information is, for example, XML, JSON, or the like. In addition, for example, HTTP is used as a data transfer method. Communication may be performed using the same connection as the above-described connection through which the written information has been transmitted.

When transmitting correspondence relationship update information, the first transmission unit 10 H increases a transmission count corresponding to logical area information included in the correspondence relationship update information by “1” in the second transmission management DB 30 K.

In this manner, the first transmission unit 10 H executes the transmission process. That is, the first transmission unit 10 H transmits the written information and the correspondence relationship update information to the server device 20 whenever new data is written in the physical area of the data storage unit 30 A by the write unit 10 F and the physical area information of the correspondence relationship management DB 30 E is rewritten.

Incidentally, a communication interface between the first transmission unit 10 H and the host processor 14 may be realized using a unique interface or realized by modifying a standard interface such as NVM Express.

Incidentally, the read unit 10 E sometimes reads data from the data storage unit 30 A according to a read instruction signal received from the read instruction unit 14 B. For example, the read instruction signal includes an address of data as a read target. The read unit 10 E calculates logical area information from the address included in the read instruction signal. Then, the read unit 10 E specifies physical area information corresponding to the calculated logical area information from the correspondence relationship management DB 30 E. Then, the read unit 10 E reads data included in a physical area indicated by the specified physical area information in the data storage unit 30 A, and writes the data in the instructed memory. Then, the read unit 10 E may notify the read instruction unit 14 B of a signal indicating read completion.

Next, the acquisition unit 10 A will be described.

The acquisition unit 10 A acquires the erase permission notification and the rewrite permission notification from the server device 20 via the reception unit 14 D and the communication unit 16 A. A communication interface at the time of this acquisition is, for example, an interface such as standard NVM Express or an interface created independently.

The erase permission notification is information configured to notify permission to erase data stored in a specific physical area of the data storage unit 30 A. The erase permission notification includes a storage ID, a first erase code configured to erase specific data, and physical area information indicating a physical area of the specific data. The storage ID is not necessarily included in the erase permission notification such as when communication is performed while keeping connection for each storage. It is because any storage ID to which the erase permission notification corresponds can be specified based on the connection in such a case.

The specific data is data as an erase target stored in the data storage unit 30 A.

The first erase code is a code used at the time of erasing the specific data. The first erase code is, for example, a one-time password issued every time specific data is erased. The first erase code is generated based on the specific data and the first authentication information.

The first authentication information is authentication information configured to authenticate specific data. In the present embodiment, the first authentication information includes at least one of a transmission count of written information including the specific data to the server device 20 , and a share code assigned in advance to the storage device 10 .

Incidentally, the first authentication information may further include other parameters. For example, the first authentication information may further include a server ID, time information, and the like. The time synchronized between the storage device 10 and the server device 20 may be used as the time information.

In the present embodiment, the description is given by exemplifying a case where the first authentication information includes a transmission count of written information including specific data to the server device 20 , and the share code assigned in advance to the storage device. Incidentally, the share code is a share code registered in the share code management DB 30 I of the authentication information storage unit 30 D in the storage device 10 .

The first erase code is generated by the server device 20 in the present embodiment. The server device 20 generates the first erase code with a specific algorithm that is predetermined using the specific data which is the erase target data and the first authentication information.

For example, HMAC-Based One-Time Password Algorithm described in RFC 4226 is used as the algorithm when the first erase code is a one-time password. For example, the server device 20 generates the first erase code using a calculation formula illustrated in the following Formula (1).

HOTP( K,C )=Truncate( HMAC - SHA -1( K,C ))   (1)

In Formula (1), K is a value generated using at least one of a share code and specific data. C represents a transmission count of written information including the specific data to the server device 20 .

When time synchronization can be performed between the storage device 10 and the server device 20 , time information may be further used for K.

The rewrite permission notification is information configured to instruct rewriting of logical area information of the correspondence relationship management DB 30 E. The rewrite permission notification includes a storage ID, a first rewrite code, and logical area information corresponding to physical area information as a write target. The storage ID is not necessarily included in the rewrite permission notification such as when communication is performed while keeping connection for each storage. It is because any storage ID to which the rewrite permission notification corresponds can be specified based on the connection in such a case.

The first rewrite code is a code configured to rewrite the rewrite possibility information, which indicates whether to permit rewriting of physical area information, in the correspondence relationship between the physical area information as the rewrite target and the logical area information. Specifically, the first rewrite code is a code used for determination to rewrite the rewrite possibility information of the logical area information corresponding to a physical area as the rewrite target in the rewrite management DB 30 G (see FIG. 4 ) to “rewrite permission”.

The first rewrite code is a one-time password issued every time physical area information is rewritten. The first rewrite code is generated based on the physical area information as the rewrite target and the second authentication information in the correspondence relationship management DB 30 E.

The second authentication information is authentication information configured to authenticate a correspondence relationship between physical area information as a rewrite target and logical area information. In the present embodiment, the second authentication information includes at least one of a transmission count of correspondence relationship update information including the correspondence relationship (between the physical area information as the rewrite target and the logical area information) to the server device 20 and a share code assigned in advance to the storage device 10 .

Incidentally, the second authentication information may further include other parameters. For example, the second authentication information may further include a server ID, time information, and the like. The time synchronized between the storage device 10 and the server device 20 may be used as the time information.

In the present embodiment, the description is given by exemplifying a case where the second authentication information includes a transmission count of correspondence relationship update information, which includes physical area information as a rewrite target and logical area information corresponding to the physical area information, to the server device 20 and a share code assigned in advance to the storage device 10 . Incidentally, the share code is a share code registered in the share code management DB 30 I of the authentication information storage unit 30 D in the storage device 10 .

In the present embodiment, the first rewrite code is generated by the server device 20 . The server device 20 generates the first rewrite code with a predetermined specific algorithm using the physical area information as the rewrite target and the second authentication information although details thereof will be described later. For example, an algorithm similar to the algorithm of the first erase code may be used as the specific algorithm.

The acquisition unit 10 A outputs the acquired erase permission notification and rewrite permission notification to the first generation unit 10 B.

When receiving the erase permission notification, the first generation unit 10 B generates the second erase code using the specific data stored in the physical area indicated by the physical area information included in the erase permission notification and the first authentication information.

The first generation unit 108 reads the data stored in the physical area, indicated by the physical area information included in the erase permission notification, from the data storage unit 30 A as the specific data as an erase target. In the present embodiment, the first generation unit 10 B reads the specific data from the data storage unit 30 A via the read unit 10 E.

In addition, the first generation unit 10 B reads the first authentication information from the authentication information storage unit 30 D. In the present embodiment, the first generation unit 10 B acquires a share code from the share code management DB 30 I of the authentication information storage unit 30 D. In addition, the first generation unit 10 B acquires a transmission count corresponding to the physical area information included in the erase permission notification from the first transmission management DE 30 J of the authentication information storage unit 30 D. Then, the first generation unit 10 B uses the acquired share code and transmission count as the first authentication information.

Incidentally, the server device 20 may transmit erase permission notification further including the first authentication information to the storage device 10 . In this case, the first generation unit 10 B may read the first authentication information included in the erase permission notification.

Then, the first generation unit 10 B generates the second erase code using the specific data and the first authentication information. The first generation unit 10 B generates the second erase code with the algorithm used when the server device 20 generates the first erase code. Incidentally, the same algorithm may be predetermined as the algorithm used to generate the erase codes (the first erase code and the second erase code) in the storage device 10 and the server device 20 .

Then, the first generation unit 10 B determines whether the first erase code included in the erase permission notification acquired from the server device 20 corresponds to the generated second erase code.

The fact that the first erase code corresponds to the second erase code means that these erase codes have a predetermined relationship.

For example, the fact that the first erase code corresponds to the second erase code means that the first erase code and the second erase code have the same value. In addition, for example, the fact that the first erase code corresponds to the second erase code means that a value calculated by a specific algorithm based on the first erase code matches a value calculated by the algorithm based on the second erase code. In addition, the fact that the first erase code corresponds the second erase code means that the first erase code and the second erase code match values recorded in a database in which a correspondence relationship between the first erase code and the second erase code has been stored in advance.

In the present embodiment, the description is given by exemplifying a case where the fact that the first erase code corresponds to the second erase code means that the first erase code and the second erase code have the same value.

When the first erase code corresponds to the second erase code, the change unit 10 C changes the erase possibility information, which corresponds to the physical area information included in the erase permission notification in the erase management DB 30 H (see FIG. 4 ), to “erase permission”. In addition, the change unit 10 C changes the status, which corresponds to the physical area information included in the erase permission notification in the physical area management DB 30 F (see FIG. 3B ), to “wait for erase”.

Then, the first generation unit 10 B outputs erasability notification to the erase unit 10 D when the first erase code corresponds to the second erase code.

The erase unit 10 D erases the data stored in the physical area in which the erase possibility information corresponding to the physical area information is set to “erasable” in the erase management DB 30 H (see FIG. 4 ).

Specifically, the erase unit 10 D executes the following erase process.

When receiving the erasability notification from the first generation unit 10 B, determination on whether to perform the current erase process is performed, and the erase process is performed if conditions are satisfied. These conditions differ depending on storage devices, and the determination is performed by considering a timing so as not to lower performance of the read or write process that is currently being performed. In addition, the determination may be performed at a timing at which the number of pieces of physical area information indicating “erase permission” reaches a certain number or more. If it is determined to perform the erase process, the erase unit 10 D specifies pieces of physical area information with the status “wait for erase” from the physical area management DB 30 F (see FIG. 3B ). Then, the erase unit 10 D specifies physical area information which corresponds to erase possibility information in the erase management DB 30 H (see FIG. 4 ) indicating “erase permission” among the specified pieces of physical area information with the status “wait for erase”.

Then, the erase unit 10 D erases data stored in physical area indicated by the specified physical area information from the physical area.

The erase unit 10 D increases an erase count corresponding to physical area information indicating the erased physical area by “1” in the physical area management DE 30 F. In addition, the erase unit 10 D changes a status corresponding to the physical area information indicating the erased physical area in the physical area management DB 30 F to “erased”.

In this manner, the erase unit 10 D performs the erase process when receiving the erasability notification from the first generation unit 10 B.

On the other hand, when receiving rewrite permission notification from the acquisition unit 10 A, the first generation unit 10 B generates a second rewrite code using physical area information corresponding to logical area information included in the rewrite permission notification and the second authentication information.

The first generation unit 10 B reads the physical area information corresponding to the logical area information included in the rewrite permission notification from the correspondence relationship management DB 30 E (see FIG. 3B ). In the present embodiment, the first generation unit 10 B reads the physical area information via the read unit 10 E.

In addition, the first generation unit 10 B reads the second authentication information from the authentication information storage unit 30 D. In the present embodiment, the first generation unit 10 B acquires a share code from the share code management DB 30 I of the authentication information storage unit 30 D. In addition, the first generation unit 10 B obtains a transmission count corresponding to the logical area information included in the rewrite permission notification from the second transmission management DP 30 K of the authentication information storage unit 30 D. Then, the first generation unit 10 B uses the acquired share code and transmission count as the second authentication information.

Incidentally, the server device 20 may transmit rewrite permission notification further including the second authentication information to the storage device 10 . In this case, the first generation unit 10 B may read the second authentication information included in the rewrite permission notification.

Then, the first generation unit 10 B generates the second rewrite code using the read physical area information and second authentication information. The first generation unit 10 B generates the second rewrite code with the algorithm used when the server device 20 generates the first rewrite code. Incidentally, the same algorithm may be predetermined as the algorithm used to generate the rewrite codes (the first rewrite code and the second rewrite code) in the storage device 10 and the server device 20 .

Then, the first generation unit 103 determines whether the first rewrite code included in the rewrite permission notification acquired from the server device 20 corresponds to the generated second rewrite code.

The fact that the first rewrite code corresponds the second rewrite code means that these rewrite codes have a predetermined relationship.

For example, the fact that the first rewrite code corresponds to the second rewrite code means that the first rewrite code and the second rewrite code have the same value. In addition, for example, the fact that the first rewrite code corresponds to the second rewrite code means that a value calculated by a specific algorithm based on the first rewrite code matches a value calculated by the algorithm based on the second rewrite code. In addition, the fact that the first rewrite code corresponds to the second rewrite code means that the first rewrite code and the second rewrite code match values recorded in a database in which a correspondence relationship between the first rewrite code and the second rewrite code has been stored in advance.

In the present embodiment, the description is given by exemplifying a case where the fact that the first rewrite code corresponds to the second rewrite code means that the first rewrite code and the second rewrite code have the same value.

When the first rewrite code corresponds to the second rewrite code, the change unit 10 C changes the rewrite possibility information of the physical area information in the correspondence relationship to the rewrite permission. The “correspondence relationship” indicates a correspondence relationship between the logical area information included in the rewrite permission notification and the physical area information corresponding to the logical area information. That is, the change unit 10 C changes the rewrite possibility information corresponding to the logical area information included in the rewrite permission notification in the rewrite management DB 30 G (see FIG. 4 ) to “rewrite permission”.

Thus, the physical area information corresponding to the logical area information having the rewrite possibility information changed to “rewrite permission” in the correspondence relationship management DE 30 E (see FIG. 3B ) is turned into a state where rewrite thereof has been permitted.

Functional Configuration of Server Device 20 —The description will continue returning to FIG. 2 Next, a functional configuration of the server device 20 will be described.

The server device 20 includes the storage device 22 , the host processor 24 , and the network interface controller 26 . The storage device 22 and the network interface controller 26 are connected to the host processor 24 to be communicating with each other.

The storage device 22 stores various types of information. In the present embodiment, the storage device 22 stores the data storage unit 40 A and the authentication information storage unit 40 B.

The data storage unit 40 A and the authentication information storage unit 40 B are, for example, SSDs or HDDs incorporating flash memories (non-volatile memories), or volatile memories. In the present embodiment, a case where the data storage unit 40 A is the SSD will be described as an example. Meanwhile, the authentication information storage unit 40 B may be a non-volatile memory or a volatile memory. In the present embodiment, a case where the authentication information storage unit 40 B is the volatile memory will be described as an example.

The data storage unit 40 A stores written information and correspondence relationship update information received from the storage device 10 in association with a storage ID of the storage device 10 as a transmission source of these pieces of information. The data storage unit 40 A stores a written-information management DB 40 C and a correspondence relationship management DB 40 D for each of the storage devices 10 in the present embodiment.

FIG. 6 is a schematic diagram illustrating exemplary data configurations of the written-information management DB 40 C and the correspondence relationship management DB 40 D.

The written-information management DB 40 C is a database configured to manage the written information received from the storage device 10 . Incidentally, the data configuration of the written-information management DB 40 C is not limited to the database.

The written-information management DB 40 C is obtained by associating time, physical area information, and data with each other. The time in the written-information management DB 40 C is preferably information with which a reception order with another data can be specified. The time in the written-information management DB 40 C is, for example, a reception time of written information. When time information is included in the written information, a time indicated in the time information may be used as the time in the writing management DB 40 C.

The physical area information and data in the written-information management DB 40 C are physical area information and data included in the written information received at the corresponding time.

The correspondence relationship management DB 40 D is a database configured to manage the correspondence relationship update information received from the storage device it. Incidentally, the data configuration of the correspondence relationship management DB 40 D is not limited to the database.

The correspondence relationship management DB 40 D is obtained by associating time, logical area information, and physical area information with each other. The time in the correspondence relationship management DB 40 D is preferably information with which a reception order with another data can be specified. For example, the time in the correspondence relationship management DB 40 D is a reception time of correspondence relationship update information. When the correspondence relationship update information includes time information, a time indicated in the time information may be used as the time in the correspondence relationship management DB 40 D.

The logical area information and physical area information in the correspondence relationship management DB 40 D are logical area information and physical area information included in the correspondence relationship update information received at the corresponding time.

The written-information management DB 40 C and the correspondence relationship management DB 40 D are additionally written by the host processor 24 whenever the written information and the correspondence relationship update information are received from the storage device 10 .

The description will continue returning to FIG. 2 . Next, the authentication information storage unit 40 B will be described. The authentication information storage unit 40 B stores authentication information. In the present embodiment, the authentication information storage unit 40 B stores a share code management DB 40 E, a third transmission management DB 40 B, and a fourth transmission management DB 40 G for each of the storage devices 10 .

FIG. 7 is a schematic diagram illustrating exemplary data configurations of the share code management DB 40 E, the third transmission management DB 40 F, and the fourth transmission management DB 40 G. As illustrated in FIG. 7 , the authentication information storage unit 40 B stores the share code management DB 40 E, the third transmission management DB 40 F, and the fourth transmission management DB 40 G for each of the storage devices 10 .

The share code management DB 40 E is a database configured to manage a share code shared with the corresponding storage device 10 . Incidentally, a data format of the share code management DB 40 E is not limited to the database. The share code management DB 40 E indicates the storage ID and the share code. Since the definition of the share code has been described above, the description thereof will be omitted here.

The third transmission management DB 40 F manages information relating to the written information received from the storage device 10 . In the present embodiment, the third transmission management DB 40 F is a database in which physical area information and a transmission count are associated with each other. Incidentally, a data format of the third transmission management DB 40 F is not limited to the database.

The “transmission count” in the third transmission management DB 40 F indicates the number of times of reception of the written information including the corresponding physical area information from the storage device 10 .

The fourth transmission management DB 40 G manages information relating to the correspondence relationship update information received from the storage device 10 . In the present embodiment, the fourth transmission management DE 40 G is a database in which logical area information and a transmission count are associated with each other. Incidentally, a data format of the fourth transmission management DB 40 G is not limited to the database.

The “transmission count” in the fourth transmission management DB 40 G indicates the number of times of reception of the correspondence relationship information including the corresponding logical area information from the storage device 10 .

It is assumed that the share code management DB 40 E is stored in advance. The third transmission management DB 40 F and the fourth transmission management DB 40 G are updated by the processing of the host processor 24 (to be described in detail later).

Next, the network interface controller 26 will be described returning to FIG. 2 . The network interface controller 26 includes a communication unit 26 A. The communication unit 26 A communicates with the storage device 10 . In the present embodiment, the communication unit 26 A communicates with the storage device 10 via the network interface controller 16 of the vehicle 2 and the host processor 14 .

Specifically, the communication unit 26 A receives the written information and the correspondence relationship update information from the storage device 10 . The communication unit 26 A outputs the received written information and correspondence relationship update information to the host processor 24 . In addition, the communication unit 26 A receives the erase permission notification and the rewrite permission notification from the host processor 24 . Then, the communication unit 26 A transmits the received erase permission notification and rewrite permission notification to the storage device 10 .

The host processor 24 performs management of data stored in the storage device 22 , control of transmission of various information to the storage device 10 , and the like.

The host processor 24 includes a reception unit 24 A, a second generation unit 24 B, and a second transmission unit 24 C.

The reception unit 24 A receives the written information and the correspondence relationship information from the storage device 10 via the communication unit 26 A.

When receiving the written information, the reception unit 24 A determines whether a transmission count of written information included in the written information matches a corresponding transmission count managed by the storage device 22 .

Specifically, the reception unit 24 A specifies the third transmission management DB 40 F (see FIG. 7 ) corresponding to the storage ID included in the received written information. Then, the reception unit 24 A reads a transmission count corresponding to physical area information included in the received written information in the specified third transmission management DB 40 F. The reception unit 24 A uses the read transmission count as the corresponding transmission count managed by the storage device 22 .

Then, when the transmission count of the written information included in the written information matches the corresponding transmission count managed by the storage device 22 , the reception unit 24 A stores the written information In the data storage unit 40 A of the storage device 22 .

Specifically, the reception unit 24 A specifies the written-information management DB 40 C, associated with the storage ID included in the written information received from the storage device 10 , in the data storage unit 40 A. Then, the reception unit 24 A registers a time at which the written information is received and the physical area information and data included in the written information in the specified written-information management DB 40 C in association with each other. Incidentally, the reception unit 24 A may further register at least one of a size of the physical area information and a size of the data in the written-information management DB 40 C in association with each other.

Meanwhile, when receiving the correspondence relationship update information, the reception unit 24 A determines whether a transmission count of correspondence relationship update information included in the correspondence relationship update information matches a corresponding transmission count managed by the storage device 22 .

Specifically, the reception unit 24 A specifies the fourth transmission management DB 40 G (see FIG. 7 ) corresponding to the storage ID included in the received correspondence relationship update information. Then, the reception unit 24 A reads a transmission count corresponding to logical area information included in the received correspondence relationship update information in the specified fourth transmission management DB 40 G. The reception unit 24 A uses the read transmission count as the corresponding transmission count managed by the storage device 22 .

Then, when the transmission count of the correspondence relationship update information included in the correspondence relationship update information matches the corresponding transmission count managed by the storage device 22 , the reception unit 24 A stores the correspondence relationship update information in the data storage unit 40 A of the storage device 22 .

Specifically, the reception unit 24 A specifies the correspondence relationship management DB 40 D, associated with the storage ID included in the correspondence relationship update information received from the storage device 10 , in the data storage unit 40 A. Then, the reception unit 24 A registers a time at which the correspondence relationship update information is received and the logical area information and physical area information included in the correspondence relationship update information in the specified correspondence relationship management DB 40 D in association with each other.

Next, the second generation unit 24 B will be described. The second generation unit 24 B generates the first erase code and the first rewrite code. That is, the above-described generation of the first erase code and the first rewrite code using the server device 20 is performed by the second generation unit 24 B of the server device 20 .

First, the generation of the first erase code will be described. The second generation unit 24 B generates the first erase code with the specific algorithm that is predetermined using the specific data which is the erase target data and the first authentication information. Since the definitions of the first erase code and the specific algorithm have been described above, the descriptions thereof will be omitted here.

For example, the second generation unit 24 B generates the first erase code when receiving written information from the storage device 10 . In detail, the second generation unit 24 B uses data included in the written information received from the storage device 10 as data (specific data) as an erase target. Incidentally, the second generation unit 24 B may read the data from the data storage unit 40 A and use the read data as the specific data. Incidentally, the second generation unit 24 B may use another arbitrary data as the specific data.

The second generation unit 24 B acquires the first authentication information from the authentication information storage unit 40 B. For example, the second generation unit 24 B specifies a storage ID corresponding to the erase target data from the data storage unit 40 A. Then, the second generation unit 24 B specifies a share code corresponding to the specified storage ID from the authentication information storage unit 40 B.

In addition, the second generation unit 24 B specifies physical area information corresponding to the specified storage ID and the erase target data from the data storage unit 40 A. Incidentally, the second generation unit 24 B may specify the physical area information by reading physical area information included in the written information received from the storage device 10 . Then, the second generation unit 24 B specifies a transmission count corresponding to the specified physical area information from the third transmission management DB 40 B of the authentication information storage unit 40 B. Then, the second generation unit 24 B uses the specified share code and transmission count as the first authentication information.

Then, the second generation unit 24 B generates the first erase code with the predetermined specific algorithm using the specified first authentication information and the specific data which is the erase target data.

Then, the second generation unit 24 B generates erase permission notification including the generated first erase code and physical area information. The physical area information included in the erase permission notification is information indicating a physical area in the data storage unit 30 A of the storage device 10 in the specific data as a target to be erased using the first erase code. In the present embodiment, the second generation unit 24 B may use the physical area information included in the written information received from the storage device 10 as the physical area information included in the erase permission notification.

The second generation unit 24 B outputs an instruction to transmit the erase permission notification to the storage device 10 to the second transmission unit 24 C. A transmission destination of the erase permission notification is the storage device 10 identified by the storage ID included in the written information which has been used to create the erase permission notification.

Further, the second generation unit 24 B increases a transmission count corresponding to the physical area information included in the erase permission notification in the third transmission management DB 40 F corresponding to the storage ID by “1” in the authentication information storage unit 40 B.

Next, the generation of the first rewrite will be described.

The second generation unit 24 B further generates the first rewrite code based on physical area information and the second authentication information configured to authenticate a correspondence relationship between the physical area information and logical area information. The second generation unit 24 B generates the first rewrite code with the predetermined specific algorithm using the physical area information and the second authentication information. Since the definitions of the first rewrite code and the specific algorithm have been described above, the descriptions thereof will be omitted here.

For example, the second generation unit 24 B generates the first rewrite code when receiving correspondence relationship update information from the storage device 10 . Specifically, the second generation unit 24 B specifies physical area information included in the correspondence relationship update information received from the storage device 10 as physical area information as a rewrite target.

Then, the second generation unit 24 B specifies the second authentication information used to generate the first rewrite code. For example, the second generation unit 24 B acquires the second authentication information from the authentication information storage unit 40 B. For example, the second generation unit 24 B specifies a share code corresponding to a storage ID included in the correspondence relationship update information received from the storage device 10 from the authentication information storage unit 40 B.

In addition, the second generation unit 24 B specifies a transmission count, which corresponds to the identified storage ID and the logical area information included in the correspondence relationship update information received from the storage device 10 , from the fourth transmission management DB 40 G (see FIG. 7 ).

Then, the second generation unit 24 B uses the specified share code and transmission count as the second authentication information. The second generation unit 24 B generates the first rewrite code with the predetermined specific algorithm using the specified physical area information and second authentication information.

Then, the second generation unit 24 B generates rewrite permission notification including the generated first rewrite code and the logical area information corresponding to the physical area information as the rewrite target. The second generation unit 24 B may use the logical area information included in the correspondence relationship update information received from the storage device 10 as the logical area information included in the write instruction information.

Then, the second generation unit 24 B outputs an instruction to transmit the rewrite permission notification to the storage device 10 to the second transmission unit 24 C. A transmission destination of the rewrite permission notification is the storage device 10 identified by the storage ID included in the correspondence relationship update information used to create the rewrite permission notification.

Further, the second generation unit 24 B increases a transmission count corresponding to the logical area information included in the write instruction information of the fourth transmission management DB 40 G corresponding to the storage ID by “1” in the authentication information storage unit 40 B.

The second transmission unit 24 C transmits the erase permission notification including the first erase code and the physical area information to the storage device 10 . In addition, the second transmission unit 24 C transmits rewrite permission notification including the first rewrite code and the logical area information corresponding to the physical area information as the rewrite target to the storage device 10 .

In detail, the second transmission unit 24 C transmits the erase permission notification received from the second generation unit 24 B to the storage device 10 indicated by the transmission instruction via the communication unit 26 A. In detail, the second transmission unit 24 C transmits the rewrite permission notification received from the second generation unit 24 B to the storage device 10 indicated by the transmission instruction via the communication unit 26 A.

Next, an exemplary procedure of storage control processing executed by the storage device 10 according to the present embodiment will be described.

in the present embodiment, the storage control processing includes a write process, a transmission process, a read process, an erase/rewrite process, and an erase process.

First, the write process executed by the storage device 10 is executed. FIG. 8 is a flowchart illustrating an exemplary procedure of the write process executed by the storage device 10 .

First, the write unit 10 F determines whether a write instruction is received from the write instruction unit 14 A of the host processor 14 (Step S 100 ). When a negative determination is made in Step S 100 (Step S 100 : No), this routine is ended. When it is determined that the write instruction is received (Step S 100 : Yes), the process proceeds to Step S 102 .

In Step S 102 , the write unit 10 F determines whether the physical area information corresponding to the logical area information used for writing can be rewritten based on the write instruction received in Step S 100 (Step S 102 ). In Step S 102 , the write unit 10 F determines whether the rewrite possibility information corresponding to the logical area information used for writing in the rewrite management DB 30 G indicates “rewrite permission”. With this determination, the write unit 10 F performs the determination of Step S 102 .

When a negative determination is made in Step S 102 (Step S 102 : No), the process proceeds to Step S 124 . In Step S 124 , the write unit 10 F notifies the host processor 14 of a data write error (Step S 124 ). Then, this routine is ended.

When an affirmative determination is made in Step S 102 (Step S 102 : Yes), the process proceeds to Step S 104 . In Step S 104 , the write unit 10 F determines whether there is an “erased” physical area (Step S 104 ). The write unit 10 F performs this determination by determining whether the physical area information associated with the status “erased” is registered in the physical area management DB 30 F (see FIG. 3B ).

When a negative determination is made in Step S 104 (Step S 104 : No), the process proceeds to Step S 124 . When an affirmative determination is made in Step S 104 (Step S 104 : Yes), the process proceeds to Step S 106 .

In Step S 106 , the write unit 10 F selects one physical area information associated with the status “erased” from the physical area management DB 30 F. Then, the write unit 10 F writes the write target data in the physical area indicated by the selected physical area information (Step S 106 ).

Next, the write unit 10 F determines whether the writing in Step S 106 is normally ended (Step S 108 ). When it is determined that the writing is abnormally ended (Step S 106 : No), the process proceeds to Step S 126 . In Step S 126 , the write unit 10 F changes a status, which corresponds to the physical area information of the physical area determined as being abnormally ended in Step S 108 , in the physical area management DB 30 F (see FIG. 3B ) to “invalid” (Step S 126 ). Then, the process returns to the above-described Step S 104 .

On the other hand, when it is determined in Step S 108 that the writing is normally ended (Step S 108 : Yes), the process proceeds to Step S 110 . In Step S 110 , the write unit 10 F changes a status, which corresponds to the physical area information of the physical area in which the data has been written in Step S 106 in the physical area management DB 30 F (see FIG. 3B ), to “in use” (Step S 110 ).

Next, the write unit 10 F rewrites the physical area information corresponding to the logical area information used to write the data in the correspondence relationship management DB 30 E (see FIG. 3B ) with the physical area information of the physical area in which the data has been written in Step S 106 (Step S 112 ).

Next, the write unit 10 F sets erase possibility information, which corresponds to the physical area information of the physical area in which the data has been written in Step S 106 in the erase management DB 30 H (see FIG. 4 ), to “erase prohibition” (Step S 114 ). Then, the write unit 10 F sets rewrite possibility information of logical area information, which corresponds to the physical area information of the physical area in which the data has been written in Step S 106 in the rewrite management DB 30 G, to “rewrite prohibition” (Step S 116 ).

Then, the write unit 10 F sets a status of physical area information, associated with the logical area information used for the writing of data in Step S 106 in a previous time (before the current writing), in the physical area management DB 30 F (see FIG. 3B ) to “wait for erase” (Step S 118 ).

Then, the write unit 10 F notifies the first transmission unit 10 H of an instruction to transmit the written information and the correspondence relationship update information (Step S 120 ). Next, the write unit 10 F notifies the host processor 14 of write completion (Step S 122 ), this routine is ended.

Next, an exemplary procedure of the transmission process executed by the first transmission unit 10 H will be described. FIG. 9 is a flowchart illustrating the exemplary procedure of the transmission process.

The first transmission unit 10 H determines whether a transmission instruction is received from the write unit 10 F (Step S 200 ). When a negative determination is made in Step S 200 (Step S 200 : No), this routine is ended. When an affirmative determination is made in Step S 200 (Step S 200 : Yes), the process proceeds to Step S 202 .

In Step S 202 , the first transmission unit 10 H transmits the written information to the server device 20 (Step S 202 ). The first transmission unit 10 H transmits the written information including the storage ID of the storage device 10 , the data written in Step S 106 (see FIG. 6 ), the physical area information of the physical area in which the data has been written, and the transmission count of the written information, to the server device 20 .

Then, the first transmission unit 10 H increases a transmission count corresponding to physical area information included in the written information by “1” in the first transmission management DB 30 J (Step S 204 ).

Next, the first transmission unit 10 H transmits the correspondence relationship update information to the server device 20 (Step S 206 ). The first transmission unit 10 H transmits the correspondence relationship update information including the storage ID of the storage device 10 , the physical area information rewritten in Step S 112 (see FIG. 8 ), the logical area information corresponding to the physical area information in the correspondence relationship management DB 30 E, and the transmission count of the correspondence relationship update information to the server device 20 .

Next, the first transmission unit 10 H increases a transmission count corresponding to logical area information included in the correspondence relationship update information by “1” in the second transmission management DB 30 K (Step S 208 ). Then, this routine is ended.

Next, an exemplary procedure of the read process executed by the storage device 10 will be described. FIG. 10 is a flowchart illustrating the exemplary procedure of the read process.

First, the read unit 10 E determines whether a read instruction signal is received from the read instruction unit 14 B of the host processor 14 (Step S 300 ). When a negative determination is made in Step S 300 (Step S 300 : No), this routine is ended. When an affirmative determination is made in Step 3300 (Step S 300 : Yes), the process proceeds to Step S 302 .

In Step S 302 , the read unit 10 E calculates logical area information from the address included in the read instruction signal. Then, the read unit 10 E specifies physical area information corresponding to the calculated logical area information from the correspondence relationship management DB 30 E (Step S 302 ).

Then, the read unit 10 E reads data included in a physical block indicated by the physical area information specified in Step S 302 in the data storage unit 30 A (Step S 304 ). Then, the read unit 10 E writes the read data to the memory instructed by the read instruction. Then, the read unit 10 E notifies the host processor 14 of the signal indicating the read completion (Step S 306 ). Then, this routine is ended.

Next, the reception process executed by the storage device 10 will be described. FIG. 11 is a flowchart illustrating the exemplary procedure of the reception process.

First, the acquisition unit 10 A determines whether erase permission notification is acquired (Step S 500 ). The acquisition unit 10 A makes a determination in Step S 500 by determining whether the erase permission notification received from the server device 20 via the host processor 14 and the network interface controller 16 .

When a negative determination is made in Step S 500 (Step S 500 : No), the process proceeds to Step S 516 to be described later. On the other hand, when an affirmative determination is made in Step S 500 (Step S 500 : Yes), the process proceeds to Step S 502 . In Step S 502 , the first generation unit 10 B reads specific data from the data storage unit 30 A (Step S 502 ). The first generation unit 10 B reads the data stored in the physical area, indicated by the physical area information included in the erase permission notification acquired in Step S 500 , from the data storage unit 30 A as the specific data as the erase target.

Next, the first generation unit 10 B reads the first authentication information from the authentication information storage unit 30 D (Step S 504 ). For example, the first generation unit 10 B acquires a share code from the share code management DB 30 I of the authentication information storage unit 30 D. In addition, the first generation unit 10 B acquires a transmission count corresponding to the physical area information included in the erase permission notification from the first transmission management DB 30 J of the authentication information storage unit 30 D. Then, the first generation unit 10 B uses the acquired share code and transmission count as the first authentication information.

Next, the first generation unit 10 B generates the second erase code using the specific data read in Step S 502 and the first authentication information read in Step S 504 (Step S 506 ).

Next, the first generation unit 10 B determines whether the first erase code included in the erase permission notification acquired in Step S 500 matches the second erase code generated in Step S 506 (Step S 508 ). When it is determined that both the codes do not match each other (Step S 508 : No), the process proceeds to Step S 528 to be described later.

On the other hand, when it is determined that both the codes match each other (Step S 508 : Yes), the process proceeds to Step S 510 . In Step S 510 , the change unit 10 C changes the erase possibility information, which corresponds to the physical area information included in the erase permission notification acquired in Step S 500 , in the erase management DB 30 H (see FIG. 4 ) to “erase permission” (Step S 510 ). Next, the change unit 10 C changes the status, which corresponds to the physical area information included in the erase permission notification acquired in Step S 500 , in the physical area management DB 30 F (see FIG. 3B ) to “wait for erase” (Step S 512 ).

Then, the first generation unit 10 B outputs the erasability notification to the erase unit 10 D (Step S 514 ).

Next, the acquisition unit 10 A determines whether rewrite permission notification is acquired (Step S 516 ). The acquisition unit 10 A makes a determination in Step S 516 by determining whether the rewrite permission notification is received from the server device 20 via the host processor 14 and the network interface controller 16 .

When a negative determination is made in Step S 516 (Step S 516 : No), this routine is ended. On the other hand, when an affirmative determination is made in Step S 516 (Step S 516 : Yes), the process proceeds to Step S 518 .

In Step S 518 , the first generation unit 10 B reads the physical area information corresponding to the logical area information included in the rewrite permission notification acquired in Step S 516 from the correspondence relationship management DB 30 E (see FIG. 3B ) (Step S 518 ).

Next, the first generation unit 10 B reads the second authentication information from the authentication information storage unit 30 D (Step S 520 ).

Then, the first generation unit 10 B generates the second rewrite code using the physical area information read in Step S 518 and the second authentication information read in Step S 520 (Step S 522 ).

Next, the first generation unit 10 B determines whether the first rewrite code included in the rewrite permission notification acquired in Step S 516 matches the second rewrite code generated in Step S 522 (Step S 524 ).

When an affirmative determination is made in Step S 524 (Step S 524 : Yes), the process proceeds to Step S 526 . In Step S 526 , the change unit 10 C changes the rewrite possibility information, which corresponds to the logical area information included in the rewrite permission notification acquired in Step S 516 , in the rewrite management DB 30 G (see FIG. 4 ) to “erase rewrite” (Step S 526 ). Then, this routine is ended.

On the other hand, when a negative determination is made in Step S 524 (Step S 524 : No), the process proceeds to Step S 528 . In Step S 528 , the first generation unit 10 B notifies the server device 20 of error information indicating an error such as tampering and an attack via the host processor 14 and the network interface controller 16 (Step S 528 ). Then, this routine is ended.

Next, an exemplary procedure of the erase process executed by the storage device 10 will be described. FIG. 12 is a flowchart illustrating the exemplary procedure of the erase process.

First, the erase unit 10 D determines whether erasability notification is received from the first generation unit 10 B (Step S 600 ). When a negative determination is made in Step S 600 (Step S 600 : No), this routine is ended. On the other hand, when an affirmative determination is made in Step S 600 (Step S 600 : Yes), the process proceeds to Step S 602 .

In Step S 602 , the erase unit 10 D determines whether to perform the erase process (Step S 602 ). For example, the erase unit 10 D makes a determination in Step S 602 by determining whether a predetermined condition is satisfied. The erase unit 10 D determines that the predetermined condition is satisfied at a timing at which the performance of the read process or the write process that is being currently performed is not lowered. Examples of the predetermined condition include a condition that the number of pieces of physical area information with “erase permission” is a certain number or more, and the like. Incidentally, the storage device 10 may omit the process of Step S 600 and repeat the processes of Steps S 602 to S 612 in this flowchart.

When an affirmative determination is made in Step S 602 (Step S 602 : Yes), the process proceeds to Step S 604 . When a negative determination is made in Step S 602 (Step S 602 : No), this routine is ended.

In Step S 604 , the erase unit 10 D determines whether there is physical area information with the status “wait for erase” (Step S 604 ). The erase unit 10 D makes a determination in Step S 604 by determining whether there is the physical area information with the status “wait for erase” in the physical area management DB 30 F (see FIG. 3B ).

When a negative determination is made in Step S 604 (Step S 604 : No), this routine is ended. On the other hand, when an affirmative determination is made in Step S 604 (Step S 604 : Yes), the erase unit 10 D repeats the processes in Steps S 604 to S 612 for each of the physical areas with the status “wait for erase”.

First, the erase unit 10 D determines whether the corresponding erase possibility information in the erase management DB 30 H (see FIG. 4 ) indicates “erase permission” for the physical area information with the status “wait for erase” (Step S 606 ). When a negative determination is made in Step S 606 (Step S 606 : No), the repetition processing is ended. On the other hand, when an affirmative determination is made in Step S 606 (Step S 606 : Yes), the process proceeds to Step S 608 .

In Step S 608 , the erase unit 10 D erases the data stored in the physical area indicated by the physical area information in the data storage unit 30 A (Step S 608 ).

Next, the erase unit 10 D increases an erase count corresponding to physical area information indicating the erased physical area by “1” in the physical area management DB 30 F (Step S 610 ). Next, the erase unit 10 D changes a status corresponding to the physical area information indicating the erased physical area in the physical area management DB 30 F to “erased” (Step S 612 ).

Then, the erase unit 10 D repeats the processes of Steps S 604 to S 612 for each of the physical areas with the status “wait for erase”, and then, this routine is ended.

Next, a procedure of the information processing executed by the server device 20 will be described. FIG. 13 is a flowchart illustrating an exemplary procedure of the information processing executed by the server device 20 .

First, the reception unit 24 A of the server device 20 determines whether written information is received from the storage device 10 (Step S 400 ). When a negative determination is made in Step S 400 (Step S 400 : No), the process proceeds to Step S 414 to be described later. When an affirmative determination is made in Step S 400 (Step S 400 : Yes), the process proceeds to Step S 402 .

In Step S 402 , the reception unit 24 A determines whether a transmission count of the written information included in the written information received in Step S 400 matches a corresponding transmission count managed by the storage device 22 (Step S 402 ).

When a negative determination is made in Step S 402 (Step S 402 : No), the process proceeds to Step S 429 . In Step S 428 , the second transmission unit 24 C outputs error information indicating possibility of an attack or tampering to an external device, an output device, the storage device 10 , and the like via the network interface controller 26 (Step S 428 ). The output device is, for example, a display device or a speaker. The external device is, for example, a device operated by an administrator. Then, this routine is ended.

On the other hand, when an affirmative determination is made in Step S 402 (Step S 402 : Yes), the process proceeds to Step S 404 .

in Step S 404 , the reception unit 24 A sores the written information received in Step S 400 in the data storage unit 40 A of the storage device 22 (Step S 404 ). That is, the reception unit 24 A registers a time at which the written information is received and the physical area information and data included in the written information in the written-information management DB 40 C, which corresponds to a storage ID of the storage device 10 as a transmission source of the written information, in association with each other.

Next, the second generation unit 24 B reads a share code, which corresponds to the storage ID of the storage device 10 as the transmission source of the written information received in Step S 400 , from the share code management DB 40 E (see FIG. 7 ) (Step S 406 ).

Next, the second generation unit 24 B generates the first erase code with the predetermined specific algorithm using the data (specific data) included in the written information received in Step S 400 and the first authentication information including the share code read in Step S 406 and the transmission count (Step S 408 ).

Next, the second transmission unit 24 C transmits erase permission notification, which includes the first erase code generated in Step S 408 and the physical area information included in the written information received in Step S 400 , to the storage device 10 as the transmission source of the written information (Step S 410 ).

Next, the second transmission unit 24 C increases a transmission count, which corresponds to the physical area information included in the erase permission notification in the third transmission management DB 40 F corresponding to the storage ID of the storage device 10 that has transmitted the erase permission notification in Step S 410 , by “1” in the authentication information storage unit 40 B (Step S 412 ). Then, the process proceeds to Step S 414 .

In Step S 414 , the reception unit 24 A determines whether correspondence relationship update information is received from the storage device 10 (Step S 414 ). When a negative determination is made in Step S 414 (Step S 414 : No), this routine is ended. When an affirmative determination is made in Step S 414 (Step S 414 : Yes), the process proceeds to Step S 416 .

In Step S 416 , the reception unit 24 A determines whether a transmission count of the correspondence relationship update information included in the correspondence relationship update information received in Step S 414 matches a corresponding transmission count managed by the storage device 22 (Step S 416 ). When a negative determination is made in Step S 416 (Step S 416 : No), the process proceeds to Step S 428 . On the other hand, when an affirmative determination is made in Step S 416 (Step S 416 : Yes), the process proceeds to Step S 418 .

In Step S 418 , the reception unit 24 A stores the correspondence relationship update information received in Step S 414 in the data storage unit 40 A of the storage device 22 (Step S 418 ). The reception unit 24 A registers a time at which the correspondence relationship update information is received and the logical area information and physical area information included in the correspondence relationship update information in the correspondence relationship management DB 40 D, which corresponds to a storage ID of the storage device 10 as a transmission source of the correspondence relationship update information received in Step S 414 , in association with each other.

Next, the second generation unit 24 B reads a share code, which corresponds to the storage ID of the storage device 10 as the transmission source of the correspondence relationship update information received in Step S 414 , from the share code management DB 40 E (see FIG. 7 ) (Step S 420 ).

Next, the second generation unit 24 B generates the first rewrite code based on the physical area information included in the correspondence relationship update information received in Step S 414 and the second authentication information including the share code and the transmission count read in Step S 420 (Step S 422 ).

Next, the second transmission unit 24 C transmits rewrite permission notification, which includes the first rewrite code generated in Step 3422 and the logical area information included in the correspondence relationship update information received in Step S 414 , to the storage device 10 as the transmission source of the correspondence relationship update information (Step S 424 ).

Next, the second generation unit 24 B increases a transmission count corresponding to the logical area information included in the correspondence relationship update information by “1” in the fourth transmission management DB 40 G (Step S 426 ). The fourth transmission management DB 40 G is the fourth transmission management DB 40 G corresponding to a storage ID of the storage device 10 as a transmission destination of the rewrite permission notification in Step S 424 in the authentication information storage unit 40 B. Then, this routine is ended.

As described above, the storage device 10 of the present embodiment includes the acquisition unit 10 A, the first generation unit 10 B, and the erase unit 10 D. The acquisition unit 10 A acquires the erase permission notification. The erase permission notification includes the first erase code and the physical area information. The first erase code is the code configured to erase the specific data and is the code that is generated based on the specific data and the first authentication information configured to authenticate the specific data. The physical area information indicates the physical area of the specific data. The first generation unit 10 B generates the second erase code using the specific data stored in the physical area indicated by the physical area information and the first authentication information. When the first erase code corresponds to the second erase code, the erase unit 10 D erases the data stored in the physical area indicated by the physical area information.

As described above, when the second erase code generated based on the specific data stored in a physical area as an erase target of the storage device 10 and the first authentication information corresponds the first erase code acquired from the server device 20 , the storage device 10 of the present embodiment erases data stored in the physical area. That is, the storage device 10 requires the erase permission notification acquired from the outside for erasing of data. Then, when the first erase code included in the erase permission notification corresponds to the second erase code generated on the side of the storage device 10 , the storage device 10 erases the specific data indicated by the erase permission notification from the storage device 10 .

Thus, the storage device 10 of the present embodiment can suppress the data stored in the storage device 10 from being erroneously updated or erased due to vulnerability of the program executed by the host processor 14 of the vehicle 2 .

Therefore, the storage device 10 of the present embodiment can preserve the data of the storage device 10 .

In addition, the server device 20 stores the written information and the correspondence relationship update information received from the storage device 10 . Then, the server device 20 transmits the erase permission notification and the rewrite permission notification to the storage device 10 according to the stored written information and correspondence relationship update information.

In this manner, the data of the storage device 10 is uploaded to the server device 20 so that the data can be preserved.

(Modification)

Incidentally, a communication path between the vehicle (the storage device 10 ) and the server device 20 may be encrypted by transport layer security (TLS). In addition, when authentication of a server is performed, a server certificate is authenticated by certificate authorities in advance. Then, the authentication information storage unit 40 B of the server device 20 further stores the server certificate and a server secret key. The authentication information storage unit 30 D of the storage device 10 may further store a root certificate in advance. In addition, authentication of a client may be also performed using a client certificate in the same manner.

Incidentally, the description has been given in the above-described embodiment by exemplifying the case where the physical area indicates the physical block and the physical area information indicates the physical block number. In addition, the description has been given in the above-described embodiment by exemplifying the case where the logical area information indicates the logical block number.

Thus, the description has been given in the above-described embodiment with the example in which the erasing of the block and rewriting of the correspondence relationship management DB 30 E (see FIG. 3B ) are permitted in units of blocks as erase units of the NAND flash memory.

However, the physical area may indicate the physical page, and the physical area information may indicate the physical page number as described above. In this case, it is possible to manage the erasing and the rewriting of the correspondence relationship management DB 30 E (see FIG. 3B ) in units of pages as write/read units of the NAND flash memory. In the case of management in units of pages, the erasing of a block may be performed by moving data such that pages set to “erase permission” are gathered to perform erasing in units of blocks. Information on this movement of data may also be transmitted as the correspondence relationship update information.

In addition, the mode in which the correspondence relationship management DB 30 E is managed within the storage device 10 has been illustrated in the above-described embodiment. However, the correspondence relationship management DE 30 E may be managed by the host processor 14 side such as an Open Channel SSD.

In addition, the single storage device 10 is provided for the single vehicle 2 in the above-described embodiment. However, the single vehicle 2 may be provided with a plurality of the storage devices 10 . In this case, each piece of information may be managed for each of storage IDs of the storage devices 10 in the storage system 1 .

In addition, the erasing and rewriting control is performed for the entire storage device 10 in the above-described embodiment. However, the erasing and rewriting control may be performed for a part of the storage device 10 .

In addition, the mode in which the storage device 10 transmits both the written information and the correspondence relationship update information to the server device 20 has been described in the above-described embodiment. However, the storage device 10 may transmit one of the written information and the correspondence relationship update information to the server device 20 .

For example, there is a case where the writing of data occurs only sequentially in the storage device 10 . For example, in the case of writing of log data, the writing of data occurs only sequentially. In such a case, logical area information such as a logical block number just increases simply. Thus, in this case, the storage device 10 may transmit only the written information to the server device 20 .

In addition, the first generation unit 10 B generates the second erase code or the second rewrite code using the specific data and the first authentication information when receiving the erase permission notification or the rewrite permission notification in the above-described embodiment, but may store the second erase code or the second rewrite code in advance at the time of generating the written information or the correspondence relationship update information and determine correspondence between codes using the stored second erase code or second rewrite code when receiving the erase permission notification or the rewrite permission notification.

(Hardware Configuration)

Next, an example of a hardware configuration of the storage device 10 of the above-described embodiment will be described. FIG. 14 is an example of a hardware configuration diagram of the storage device 10 according to the above-described embodiment.

The storage device 10 according to the above-described embodiment has the hardware configuration which includes a control device such as a CPU 86 , a read only memory (ROM) 88 , a random access memory (RAM) 90 , a NAND flash memory 92 , an I/F unit 82 which is an interface between the host processor 14 and the storage device 10 , and a bus 96 that connects the respective units. For example, the I/F unit provides an interface such as NVM Express to the host processor 14 . In addition, the NAND flash memory 92 is connected by an interface such as Toggle DDR.

In the storage device 10 according to the above-described embodiment, the above-described units are realized on the storage device 10 as the CPU 86 reads a program from the ROM 88 onto the RAM 90 and executes the program. A part excluding the NAND flash memory 92 is also called a storage controller, and particularly an SSD controller in the case of an SSD.

Incidentally, the program (firmware) configured to execute the above-described respective processes executed by the storage device 10 of the above-described embodiment may be stored in the NAND flash memory 92 . In addition, the program (firmware) configured to execute the above-described respective processes executed by the storage device 10 of the above-described embodiment may be provided in the state of being incorporated in the ROM 88 in advance.

In addition, the program configured to execute the above-described processes executed by the vehicle 2 , the storage device 10 and the server device 20 of the above-described embodiment may be stored in a file of an installable format or an executable format in a computer-readable storage medium such as a CD-ROM, a CD-R, a memory card, a digital versatile disk (DVD), and a flexible disk (FD) and provided as a computer program product. In addition, the program configured to execute the above-described processes executed by the vehicle 2 , the storage device 10 and the server device 20 of the above-described embodiment may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. In addition, the program configured to execute the above-described processes executed by the vehicle 2 , the storage device 10 and the server device 20 of the above-described embodiment may be provided or distributed via a network such as the Internet.

While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel embodiments described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the embodiments described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.