Method and System for Verifying a Data Erasure Process

Abstract

A method of erasing data from a data storage apparatus comprising a memory, the method comprises writing a known data pattern to a plurality of known memory locations of the data storage apparatus, causing the data storage apparatus to perform a data erasure procedure, reading data stored at the known memory locations after completion of the data erasure procedure, comparing the read data and the data of the known data pattern, and determining a verification result based at least in part on the result of the comparison between the read data and the data of the known data pattern.

Claims

1. A method of erasing data from a data storage apparatus comprising a memory, the method comprising: writing a known data pattern to a plurality of known memory locations of the data storage apparatus; causing the data storage apparatus to perform a data erasure procedure; reading data stored at the known memory locations after completion of the data erasure procedure; comparing the read data and the data of the known data pattern; and determining a verification result based at least in part on the result of the comparison between the read data and the data of the known data pattern.

2. (canceled)

3. The method according to claim 1, wherein at least one of: a) the plurality of known memory locations of the data storage apparatus are physical locations; b) the known memory locations of the data storage apparatus are defined using logical block addressing (LBA); or c) the writing and/or reading is performed without using a file system and/or file transfer protocol associated with the memory.

4. The method according to claim 1, wherein the data erasure procedure comprises erasing data from substantially all of the addressable memory.

5. The method according to claim 1, wherein the data erasure procedure comprises writing a further data pattern to the memory.

6. The method according to claim 5, wherein the further data pattern comprises at least one of: a predefined static pattern, all 1s, all 0s, a random data pattern, a series of ones and zeroes repeated at least once, wherein the zeroes repeated at least once comprises a 0x55, 0xAA or 0x3C series repeated at least once, or a series of ones and zeroes repeated periodically, wherein the series of ones and zeroes repeated periodically comprises a 0x55, 0xAA or 0x3C series repeated periodically.

7. The method according to claim 1, wherein the data erasure procedure comprises replacing or deleting a key used to encrypt and/or decrypt data.

8. The method according to claim 1, further comprising providing a positive verification result according to whether a predetermined proportion or amount of the read data and the data of the known data pattern are different or comprising providing a positive verification result according to whether all of the read data and the data of the known data pattern are different.

9. (canceled)

10. The method according to claim 1, further comprising providing a negative verification result according to whether a predetermined proportion or amount of the read data and the data of the known data pattern are substantially the same.

11. The method according to claim 1, further comprising: in response to the providing of a negative verification result performing at least one of: causing the data storage apparatus to perform the data erasure procedure one or more additional times; indicating that the data storage apparatus should be destroyed; or performing an alternative erasure procedure.

12. The method according to claim 1, further comprising writing the known data pattern across a predetermined proportion or amount of a total data storage capacity of the data storage apparatus, for example at least 1%, 2%, 5% or 10% of the total data storage capacity of the data storage apparatus.

13. The method according to claim 12, further comprising generating the known data pattern in dependence on the predetermined proportion or amount of the total data storage capacity of the data storage apparatus.

14. The method according to claim 1, further comprising selecting a plurality of regions of the memory and writing the known data pattern to each of the regions.

15. The method according to claim 14, wherein at least one of: the plurality of regions of the memory are distributed across the memory; the plurality of regions of memory are distributed substantially periodically across physical locations in the memory; the plurality of regions of memory are spaced apart by a selected spacing in physical memory space; the plurality of regions of the memory may be distributed randomly; the plurality of regions of the memory may be selected randomly within a given subset of the memory; the plurality of regions of the memory may be selected by logically slicing the memory into a plurality of equal sized sections with one section for each region and selecting each region of the memory randomly within a corresponding one of the sections; or the plurality of regions of memory are defined using logical block addressing (LBA).

16. The method according to claim 1, wherein at least one of: the known data pattern is reproducible; the known data pattern comprises a predefined static pattern; the known data pattern is generated using an algorithm or a formula; the known data pattern comprises at least two different data values; the known data pattern comprises a series of ones and zeroes repeated at least once, for example a series of ones and zeroes repeated periodically; the known data pattern comprises a OxB5 series repeated at least once, for example a 0xB5 series repeated periodically; the known data pattern consists of multiple instances of a series of ones and zeroes, for example wherein the known data pattern consists of multiple instances of a 0B5 series; or the known data pattern is generated using a Random Number Generator (RNG) with a known fixed seed.

17. The method according to claim 1, further comprising performing a preliminary verification procedure comprising: determining whether a predetermined proportion or amount of data read from the memory are substantially identical.

18. The method according to claim 17, further comprising providing a positive initial verification result if the predetermined proportion or amount of data read from the memory are substantially identical or have consistent values, otherwise providing a negative initial verification result.

19. The method according to claim 17, further comprising: determining whether the predetermined proportion or amount of the data read from the memory are all binary zeroes or all binary ones or any other consistent pattern that repeats, for example 0xCC, 0xAA or any other clearly repeating pattern; and if the predetermined proportion or amount of data read from the memory are binary zeroes or binary ones or any other consistent pattern that repeats, for example all 0xCC, 0xAA or any other clearly repeating pattern then providing a positive initial verification result, else providing a negative initial verification result.

20. The method according to claim 17, further comprising performing the determining of said verification result in response to providing a negative initial verification result.

21. The method according to claim 1, wherein the data storage apparatus is, or comprises, at least one of an encrypting data storage apparatus, a Self-encrypting Drive (SED), a Hard Disk Drive (HDD), a Solid State Drive (SSD), Non-Volatile Memory, flash memory, NAND flash memory, Random Access Memory (RAM), or a memory card, wherein the memory card includes a MicroMediaCard (MMC), wherein the MMC includes at least one of an embedded MIVIC (eMMC) card or, a Secure Digital (SD) card.

22. The method according to claim 1, wherein the data storage apparatus stores or is associated with a data erasure routine specific to the data storage apparatus, optionally implemented in firmware, configured to perform the data erasure procedure, and the method comprises instructing by a data erasure apparatus the performance of the data erasure routine.

23. The method according to claim 1, wherein the data storage apparatus comprises at least one of hardware, firmware, or software and the data erasure procedure is defined by at least one of the hardware, firmware, or software of the data storage apparatus.

24. The method according to claim 1, further comprising connecting the data storage apparatus, or a device containing the data storage apparatus, to an external processing resource, and performing at least one of the writing of the known data pattern, the performing of the data erasure procedure, the reading of the data or the determining of the verification result under control of the external processing resource.

25. A data eraser apparatus configured to: write a known data pattern across a plurality of known memory locations of a data storage apparatus; perform, or cause the data storage apparatus to perform, a data erasure procedure; read data stored at the known memory locations after completion of the data erasure procedure; compare the read data and the data of the known data pattern; and determine a verification result based at least in part on the result of the comparison between the read data and the data of the known data pattern.

26. A computer program product comprising computer-executable instructions that are executable to: write a known data pattern across a plurality of known memory locations of a data storage apparatus; perform a data erasure procedure at the data storage apparatus; read data stored at each of the known memory locations after completion of the data erasure procedure; compare the read data and the data of the known data pattern; and determine a verification result based at least in part on the result of the comparison between the read data and the data of the known data pattern.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0098] Apparatus and methods for use in data erasure will now be described by way of non-limiting example only with reference to the drawings of which:

[0099] FIG. 1A illustrates, at a logical level, data read from a plurality of memory addresses of a data storage apparatus before the data storage apparatus performs a cryptographic data erasure procedure;

[0100] FIG. 1B illustrates, at a logical level, data read from the plurality of memory addresses of FIG. 1A after the data storage apparatus performs the cryptographic data erasure procedure to replace the key used for encryption/decryption;

[0101] FIG. 2A illustrates data stored within a plurality of memory addresses of a data storage apparatus before the data storage apparatus performs a data erasure procedure;

[0102] FIG. 2B illustrates data stored at the plurality of memory addresses of FIG. 2A after the data storage apparatus performs a data erasure procedure ;

[0103] FIG. 3A schematically illustrates a data eraser apparatus in communication with a data storage apparatus;

[0104] FIG. 3B schematically illustrates the data storage apparatus of FIG. 3A;

[0105] FIG. 3C schematically illustrates the data eraser apparatus of FIG. 3A;

[0106] FIG. 4 schematically represents a method of data erasure;

[0107] FIG. 5 schematically represents a method of determining a data erasure verification result for use with the method of data erasure of FIG. 4; and

[0108] FIG. 6 schematically represents an alternative method of determining a data erasure verification result for use with the method of data erasure of FIG. 4.

DETAILED DESCRIPTION OF THE DRAWINGS

[0109] Referring initially to FIG. 3A, there is shown a data storage apparatus 10 and a data eraser apparatus 20. In the embodiment of FIG. 3A the data storage apparatus is a self-encrypting drive. The data storage apparatus may be any other suitable type of data storage apparatus in alternative embodiments. The data storage apparatus 10 and the data eraser apparatus 20 are configured for the transfer of data there between via an interface 30. The data storage apparatus 10 is shown in more detail in FIG. 3B and the data eraser apparatus 20 is shown in more detail in FIG. 3C. Whilst the data eraser apparatus 20 is represented as a single apparatus in FIGS. 3A and 3C, it should be understood that the data eraser apparatus 20 may, alternatively, include a plurality of distributed separate devices which may collectively perform the function of the data eraser apparatus 20 as described below. Also, the data erasure eraser apparatus 20 may be located adjacent to the data storage apparatus 10 or may be located remotely from the data storage apparatus 10.

[0110] As shown in FIG. 3B, the data storage apparatus 10 includes memory 12 for data storage, firmware 14 for performing data storage and data erasure operations, and a transmitter/receiver 16 for communicating with the data eraser apparatus 20 via the interface 30. Although not shown in FIG. 3B, it should be understood that the data storage apparatus 10 may include data compression functionality for compressing data to be written to the memory 12 or for decompressing data read from the memory 12. Similarly, although not shown in FIG. 3B, it should be understood that the data storage apparatus 10 may include wear-levelling functionality for distributing data to different physical memory addresses at different times to thereby extend the lifetime of the memory 12. Although in the present embodiment the data storage apparatus 10 comprises a Self-encrypting Drive (SED), it may comprise any other suitable type of storage apparatus in alternative embodiments, for example a Hard Disk Drive (HDD), a Solid State Drive (SSD), Non-Volatile Memory, flash memory, NAND flash memory, Random Access Memory (RAM), a memory card of any kind, for example a MicroMediaCard (MMC) of any kind such as an embedded MMC (eMMC) card, a Secure Digital (SD) card.

[0111] The interface 30 may operate according to, or may be compliant with, an interface standard, for example at least one of Serial AT Attachment (SATA), Parallel ATA (PATA) or the AT Attachment (ATA) or AT Attachment Packet Interface (ATAPI) standards (for example, the interface may comprise or form part of a device using the ATI or ATAPI standard), Small Computer System Interface (SCSI), Serial Attached SCSI (SAS), Universal Serial Bus (USB), Peripheral Component Interconnect Express (PCI Express or PCIe), Non-Volatile Memory Express (NVM Express or NVMe).

[0112] As shown in more detail in FIG. 3C, the data eraser apparatus 20 includes a processor 22, a memory 24, a transmitter/receiver 26 and a user interface 28. Computer-executable instructions 29 are stored in the memory 24 which, when executed by the processor 22, cause the data eraser apparatus 20 to perform the data erasure method 100 illustrated in FIG. 4. The data eraser apparatus 20 may include or may be at least one of a server, a computer, and a laptop.

[0113] With reference now to the data erasure method 100 illustrated in FIG. 4, at stage 102, the data eraser apparatus 20 writes a known data pattern or sequence across a plurality of known memory locations, such as known physical memory addresses, of the data storage apparatus 10.

[0114] In the embodiment of FIG. 4, the known data pattern or sequence is written directly to the memory locations without using a file system or file transfer protocol that may be provided on the memory device or associated with the memory, using known techniques, for example by using logical block addressing or any other suitable procedure. Thus, the known data pattern or sequence may be written directly to the logical addresses in the memory.

[0115] The writing of the known data directly to the memory locations, bypassing the file system, may be performed using any suitable known technique dependent on the particular type of memory. The selected memory locations to which the known data is written may comprise selected sectors, for example addressed using a numbering scheme supported by the physical memory. Any suitable number or distribution of sectors may be written to, and the process may be performed independently of the sizes of the sectors of the particular memory in question. In alternative embodiments, the data may be written as files using the file system, or may be written directly to physical locations without using logical block addressing or similar logical addressing scheme.

[0116] The known data pattern or sequence may be of any suitable size and have any suitable content, but usually a small data pattern is used and the same data pattern is written to multiple of the selected memory locations. In the embodiment of FIG. 4, a 2-byte hex value (say B5) is used. In some other embodiments a collection of hex values, or a generated block of random data is used as the repeating data pattern,.

[0117] The plurality of known memory locations may constitute a predetermined proportion or amount of the total data storage capacity of the data storage apparatus 10. The predetermined proportion or amount may be selected, for example by a user, prior to the data erasure period or may be pre-stored. For example, the plurality of known memory locations may constitute a sufficient proportion of the total data storage capacity of the data storage apparatus 10 to satisfy a given data erasure standard as will be described in more detail below. Additionally or alternatively, the plurality of known memory locations may constitute a user-defined proportion of the total data storage capacity of the data storage apparatus 10. The known data pattern or sequence takes the form of a reproducible data pattern or sequence such as a data pattern or sequence generated using a Random Number Generator (RNG) with a known fixed seed. Any suitable size of data pattern or sequence may be determined using the RNG and seed, for example by selecting a position or range of positions in a number sequence and generating the random numbers corresponding to the position or range of positions. Thus, it may not be necessary to temporarily store or cache a large number sequence in order to perform the verification procedure. Any suitable known RNG or procedure for generating random or pseudo-random numbers may be used.

[0118] Different parts of the random data pattern may be written to the different memory locations in some embodiments. For example, different parts of a random data pattern generating using a seed may be written to different sectors of a drive to be deleted, or random data patterns for the different sectors or other memory locations may be generated using different seeds. In some cases a different seed may be used to generate a different random data pattern for different sectors of a drive to be deleted.

[0119] If a random data pattern(s) is written to the memory, for verification purposes, more than once, for instance in response to an attempted erasure process not succeeding or not proceeding, following the first write of the random data pattern, then the second writing of the random data pattern may be of a different random data pattern, e.g. generated using a different seed

[0120] In some embodiments a different seed is used to generate the random data pattern when the method is used to erase data from different data storage apparatus. For example, each time the method is used to erase data from a different device, a different seed may be used. In some embodiments, several data storage devices may be erased in parallel using the same data eraser apparatus. In such embodiments, for example, the same random data pattern/seed may be used for each of the data storage devices.

[0121] At stage 104, the data eraser apparatus 20 sends a command to the data storage apparatus 10 via the interface 30 to cause the data storage apparatus 10 to perform a data erasure procedure defined by the firmware 14 of the data storage apparatus 10.

[0122] In the embodiment of FIG. 3, the data storage apparatus 10 comprises an encrypting storage apparatus, in this case a self-encrypting drive, and the data erasure procedure at stage 104 comprises deleting, replacing or overwriting a key, for example a media encryption key, stored by the encrypting drive and used by the encrypting drive as part of an encryption and/or decryption process to encrypt and/or decrypt data stored by the data storage apparatus. If the deletion, replacement or overwriting of the key is successful then data that is subsequently read from the drive may be decrypted but the decrypted data will not reflect the original, stored, meaningful data (e.g. data that may be used to build files, applications or any other kind of data) and may, for example, appear to be random, pseudo-random, meaningless or useless data.

[0123] At stage 106, after completion of the data erasure procedure, the data eraser apparatus 20 reads the data stored at the known memory addresses as part of a verification procedure to determine whether the erasure procedure (in this case the deletion, replacement or overwriting of the key for example) has been performed correctly.

[0124] Subsequently, a verification result is determined at stage 108 based at least in part on the read data. For example, the verification result may be determined at stage 108 based at least in part on the result of a comparison between the read data and the data of the known data pattern as will now be described with reference to FIG. 5. Specifically, the known data pattern is reproduced or regenerated (for example using the same seed that was used to generate the known data pattern originally) and the read data and the data of the known data pattern are compared at stage 200 in FIG. 5.

[0125] At stage 202, it is determined whether a predetermined proportion of the read data and the data of the known data pattern is different. For example, it may be determined whether all of the read data and the data of the known data pattern is different. If it is determined that the predetermined proportion of the read data and the data of the known data pattern is different at stage 202, a positive verification result is provided at stage 204, indicating that the erasure procedure has been successful. Conversely, if it is determined that the predetermined proportion of the read data and the data of the known data pattern is the same, a negative verification result is provided at stage 206.

[0126] The data erasure method 100 described with reference to FIGS. 4 and 5 may be advantageous over known data erasure methods for several reasons. Firstly, in the data erasure method 100 described with reference to FIGS. 4 and 5, there may be no requirement to read data from the data storage apparatus 10 prior to the data storage apparatus 10 performing the data erasure procedure. Thus, there may be no need to store any data read from the data storage apparatus 10 prior to the data storage apparatus 10 performing the data erasure procedure. This may be particularly advantageous where a data erasure standard requires verification of data erasure for a significant proportion of the total data storage capacity of a data storage apparatus 10.

[0127] Secondly, the data erasure method 100 described with reference to FIGS. 4 and 5 may require no detailed knowledge of the data erasure procedure performed by the data storage apparatus 10, which data erasure procedure is defined in the firmware 14 of the data storage apparatus 10. In other words, the data erasure method 100 described with reference to FIGS. 4 and 5 may be reliable, verifiable and agnostic with respect to the data erasure procedure performed by the data storage apparatus 10.

[0128] Thirdly, the data erasure method 100 may provide a verification result which is scalable according to any given erasure standard and/or according to a particular user's preferences in the sense that data erasure verification may be performed by comparing the read data and the data the known data pattern across a predetermined proportion of the total data storage capacity of the data storage apparatus 10.

[0129] The erasure procedure is not necessarily self-contained. It may for example be used any time a firmware erasure command is used on a device, and/or it may be integrated as part of another standard. For example, the erasure procedure may involve various stages and one of those may be a firmware erasure procedure. According to embodiments, a fall back erasure process may be enabled depending on the outcome of a verification procedure according to embodiments. For example, according to National Institute of Standards and Technology (NIST) standards both crypto and block erase are viable means of erasing an SSD. In some embodiments if the verification procedure indicates that there has been a failure of an erasure procedure, for example for the whole device or for one or more blocks or other portions of the logical (or physical) device, a different erasure procedure may then be used, either automatically or on user command, in response to the negative verification result. For example, there may be a fall back to use of a cryptographic erasure procedure following a failed block erase procedure (or vice versa) and an indication of this may be provided to the user.

[0130] FIG. 6 illustrates an alternative method of determining the verification result, for example at stage 108 of FIG. 4. This alternative method begins at stage 300 with a preliminary verification procedure comprising an initial check to determine whether a predetermined proportion of the read data is identical. For example, stage 300 may include determining whether all of the read data is all binary zeros or all binary ones. If it is determined that a predetermined proportion of the read data is identical at stage 300, this is deemed to be indicative that the data erasure procedure performed by the data storage apparatus 10 at stage 104 has successfully replaced the sensitive data that was originally stored on the data storage apparatus 10 at the known memory addresses with redundant or null data such as all binary zeros or all binary ones, and a positive verification result is provided at stage 302. If, on the other hand, it is determined that a predetermined proportion of the read data is different at stage 300, the known data pattern is reproduced or regenerated and the read data and the data of the known data pattern are compared at stage 304. At stage 306, it is determined whether a predetermined proportion of the read data and the data of the known data pattern is different. For example, it may be determined whether all of the read data and the data of the known data pattern is different. If it is determined that the predetermined proportion of the read data and the data of the known data pattern is different at stage 306, a positive verification result is provided at stage 302. Conversely, if it is determined that the predetermined proportion of the read data and the data of the known data pattern is the same, a negative verification result is provided at stage 308.

[0131] Thus, the alternative method of determining the verification result described with reference to FIG. 6 allows for the possibility that the data storage apparatus 10 may perform an erasure operation in which the stored sensitive data is replaced with repeating redundant or null data whilst also allowing for the possibility that the data storage apparatus 10 may perform an erasure operation in which the stored sensitive data is replaced with apparently random data, for example as a result of the data storage apparatus 10 performing a cryptographic erasure procedure.

[0132] According to at least some embodiments, to counter the effects of unpredictable firmware erasure or to handle cryptographic erasure processes, means of assuring the actions may be used by the software undertaking the process. The approach to resolve this issue is to write control data to the device before firmware erasure so that the removal or absence of data can be checked. This makes it possible to assure that data has been erased as the previous state can be known in advance (the host software already knows what data it wrote). By ensuring that the known data has been removed, it can be concluded that the erasure was successful, even in situations when the result of an erasure process is random data being present. This process can scale with the user's requirements e.g. it can cover X % of the drives addressable area, meaning that the assurance related to the process can also scale.

[0133] There should be an increase in throughput for drives that do not comply with standards or produce unexpected results but still remove data. This also enables the software to highlight non-compliance with a standard. This could be useful when informing users of the software as their internal policy may require them to only use specific processes. The result of the process may be a suggestion to the user that the outcome was not the one that was expected. This may allow the user to provide further intelligence to the verification process.

[0134] A process according to certain embodiments may comprise the following:

[0135] 1. Write a known data set (the data may be, for example, a defined pattern or a pattern generated using an RNG, with a fixed seed) to specific areas throughout the drive: [0136] a. Data is spread across the device to ensure widespread coverage [0137] b. Amount of data written is based on the % selected by the user or determined by an erasure standard or other requirement

[0138] 2. Engage the firmware erasure (overwrite, crypto, block)

[0139] 3. Start verification process [0140] a. First check for a consistent pattern filling the drive surface (e.g. all 1s or all Os) which may indicate that data has been successfully erased and/or that user data is not present. [0141] b. If this fails, check instead for the absence of the previously written data.

[0142] In some embodiments, one or more of the above stages may be omitted. For example, stage 3a may be omitted in some embodiments.

[0143] One of ordinary skill in the art will appreciate that various modifications may be made to the apparatus and methods described above. For example, the data storage apparatus may comprise hardware and/or software which at least partially define the data erasure procedure performed internally within the data storage apparatus. Rather than writing a known data pattern generated using a RNG with a known fixed seed, other data patterns may be used. For example, the known data pattern may be generated using an algorithm or a formula of any kind. The known data pattern may include at least two different data values. The known data pattern may be repetitive and/or periodic. The known data pattern may be different to any data patterns known to be written by any existing types of data storage apparatus or may be different to any data specifications or data patterns defined in any existing data erasure verification standards. Writing such a different known data pattern may permit verification of the data erasure procedure performed by the data storage apparatus. Writing such a different known data pattern may also permit the type of data erasure procedure performed by the data storage apparatus to be determined in some instances. For example, if the data erasure procedure performed by the data storage apparatus overwrites a predetermined proportion of the total data storage capacity of the data storage apparatus with all binary zeros or all binary ones, stage 300 of the method shown in FIG. 6 would detect this and this information could be conveyed to a user of the data eraser apparatus 20 via the user interface 28. Alternatively, if the data erasure procedure writes random data or apparently random data to the data storage apparatus 10, stage 306 of the method shown in FIG. 6 would detect this and this information could be otherwise conveyed to a user of the data eraser apparatus 20 via the user interface 28.

[0144] Although the data erasure methods of FIGS. 4, 5 and 6 may be defined by computer-executable instructions 29 stored in the memory 24, it should be understood that at least part of the data erasure methods of FIGS. 4, 5 and 6 may be defined in hardware and/or firmware or in any other suitable fashion.

[0145] Embodiments described herein are described purely by way of example and modifications whilst still remaining within the scope of the invention as defined by the appended claims.