Method of allocating and protecting memory in computational storage device, computational storage device performing the same and method of operating storage system using the same

A computational storage device comprising:

• a plurality of nonvolatile memories;
• a buffer memory configured to temporarily store data that is stored in or to be stored in the plurality of nonvolatile memories, the buffer memory being used to perform a data processing function;
• and
• a storage controller configured to control an operation of the plurality of nonvolatile memories and an operation of the buffer memory, wherein:
• the storage controller includes:
• a first computing engine used to perform the data processing function;
• and
• a security module used to access the buffer memory, and the storage controller is configured to:
• receive a memory allocation request from a host device that is disposed outside the computational storage device;
• based on the memory allocation request, perform a memory allocation operation in which a first memory region is generated in the buffer memory and a first key associated with the first memory region is generated;
• receive a program execution request from the host device;
• and
• based on the program execution request, perform a program execution operation in which a first program is executed by the first computing engine by accessing the first memory region based on an encryption or a decryption using the first key,
• wherein performing the program execution operation includes performing at least one of an encryption operation on write data to be stored in the first memory region and a decryption operation on read data to be retrieved from the first memory region using the first key, and
• wherein performing at least one of the encryption operation and the decryption operation includes:
• reading encrypted first data from the first memory region;
• obtaining the first data by decrypting the encrypted first data using the first key;
• obtaining second data by executing the first program based on the first data;
• encrypting the second data using the first key to generate encrypted second data;
• and
• storing the encrypted second data in the first memory region.

A method of operating a storage system including a host device and a computational storage device, the computational storage device including a storage controller and a buffer memory, the storage controller performing a data processing function, the method comprising:

• transmitting, by the host device, a memory allocation request to the storage controller;
• based on the memory allocation request, performing, by the storage controller, a memory allocation operation in which a first memory region is generated in the buffer memory and a first key associated with the first memory region is generated;
• transmitting, by the host device, a program load request to the storage controller;
• based on the program load request, loading by the storage controller a first program in a program slot;
• transmitting by the host device a program activation request to the storage controller;
• based on the program activation request, transmitting by the storage controller the first program from the program slot to a first computing engine;
• transmitting by the host device a program execution request to the storage controller;
• based on the program execution request, performing by the storage controller a program execution operation in which the first program is executed by the first computing engine by accessing the first memory region based on an encryption or a decryption using the first key;
• transmitting by the host device a memory deallocation request to the storage controller;
• and
• based on the memory deallocation request, performing by the storage controller a memory deallocation operation in which the first memory region is released in the buffer memory and the first key is deleted, wherein:
• performing the program execution operation includes:
• encrypting first data, which is a target of executing the first program, using the first key to generate encrypted first data;
• storing the encrypted first data in the first memory region;
• reading the encrypted first data from the first memory region;
• obtaining the first data by decrypting the encrypted first data using the first key;
• obtaining second data, which is a result of executing the first program, by executing the first program based on the first data;
• encrypting the second data using the first key to generate encrypted second data;
• storing the encrypted second data in the first memory region;
• reading the encrypted second data from the first memory region;
• obtaining the second data by decrypting the encrypted second data using the first key;
• and
• transmitting, by the storage controller, the second data to the host device.