Niusen Chen
ABSTRACT
Flash memory has been used extensively as external storage of smartphones, tablets, IoT devices, laptops, etc. Therefore, more and more sensitive or even mission critical data are stored in flash and, once the data turn obsolete, securely deleting them is necessary for both regulation compliance and privacy protection. Traditional secure deletion on flash memory mainly focuses on sanitizing data. However, unique nature of flash memory may cause various data ''remnants'' and, even though the data are removed, the remnants may be utilized by the adversary to recover the deleted data, compromising the secure deletion guarantee.
Based on both theoretic analysis and experiments using real-world workloads, we have identified one common type of remnants in the flash memory, namely duplicates, which are caused by unique internal functions of flash storage media including garbage collection, wear leveling, bad block management. We propose RedFlash, a novel secure deletion scheme which can efficiently Remove both the data and the corresponding duplicates towards secure deletion on Flash memory. Security analysis and experimental evaluation show that RedFlash can ensure the secure deletion guarantee, at the cost of a small performance degradation, compared to a regular (non-secure) flash controller.
Supplemental Material
- Technical Note - Garbage Collection in Single-Level Cell NAND Flash Memory. https://www.micron.com/-/media/client/global/Documents/Products/Technical%20Note/NAND%20Flash/tn2960_garbage_collection_slc_nand.ashx.Google Scholar
- Jffs2. https://www.sourceware.org/jffs2/, 2003.Google Scholar
- Samsung K9GAG08B0M Datasheet. https://www.datasheet.directory/index.php?title=Special:PdfViewer&url=https%3A%2F%2Fdatasheet.iiic.cc%2Fdatasheets-0%2Fsamsung%2FK9GAG08U0M-PIB0.pdf, 2007.Google Scholar
- Memory Technology Device (MTD) Subsystem for Linux. http://www.linux-mtd.infradead.org/nand-data/nanddata.html, 2011.Google Scholar
- SNIA I/O Trace Data Files. http://iotta.snia.org/traces/, 2011.Google Scholar
- Dod manual 5220.22-m. https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/522022M.pdf?ver=2017-04-17-134632-467, 2016.Google Scholar
- Regulation (eu) 2016/679 of the european parliament and of the council. https://eur-lex.europa.eu/eli/reg/2016/679/oj, 2016.Google Scholar
- F2fs, 2019. https://www.kernel.org/doc/Documentation/filesystems/f2fs.txt.Google Scholar
- Firefly AIO-3399J. https://en.t-firefly.com/product/industry/aio_3399, 2021.Google Scholar
- Bikash Agrawal, Raymond Hansen, Chunming Rong, and Tomasz Wiktorski. Sd-hdfs: Secure deletion in hadoop distributed file system. In 2016 IEEE International Congress on Big Data (BigData Congress), pages 181--189. IEEE, 2016.Google ScholarCross Ref
- Ahmed A Ataullah, Ashraf Aboulnaga, and Frank Wm Tompa. Records retention in relational database systems. In Proceedings of the 17th ACM conference on Information and knowledge management, pages 873--882. ACM, 2008.Google ScholarDigital Library
- Sumeet Bajaj and Radu Sion. Ficklebase: Looking into the future to erase the past. In 2013 IEEE 29th International Conference on Data Engineering (ICDE), pages 86--97. IEEE, 2013.Google ScholarDigital Library
- Sumeet Bajaj and Radu Sion. Hifs: History independence for file systems. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pages 1285--1296. ACM, 2013.Google ScholarDigital Library
- Bruce McNutt Ken Bates. Umasstracerepository-search engine i/o. http://traces.cs.umass.edu/index.php/Storage/Storage, 2002.Google Scholar
- Steven Bauer and Nissanka Bodhi Priyantha. Secure data deletion for linux file systems. In Usenix Security Symposium, volume 174, 2001.Google ScholarDigital Library
- Alex Biryukov, Orr Dunkelman, Nathan Keller, Dmitry Khovratovich, and Adi Shamir. Key recovery attacks of practical complexity on aes-256 variants with up to 10 rounds. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 299--319. Springer, 2010.Google ScholarDigital Library
- Andrey Bogdanov, Dmitry Khovratovich, and Christian Rechberger. Biclique cryptanalysis of the full aes. In International Conference on the Theory and Application of Cryptology and Information Security, pages 344--371. Springer, 2011.Google ScholarDigital Library
- Daniel Boteanu and Kevvie Fowler. Bypassing self-encrypting drives (sed) in enterprise environments. In Proceedings of the Black Hat Europe Conference, 2015.Google Scholar
- Fabiano C Botelho, Philip Shilane, Nitin Garg, and Windsor Hsu. Memory efficient sanitization of a deduplicated storage system. In Presented as part of the 11th USENIX Conference on File and Storage Technologies (FAST 13), pages 81--94, 2013.Google Scholar
- Alexandre Melo Braga and Alfredo H Gallinucci Colito. Adding secure deletion to an encrypted file system on android smartphones. In Proc. SECURWARE, pages 106--110, 2014.Google Scholar
- Marcel Breeuwsma, Martien De Jongh, Coert Klaver, Ronald Van Der Knijff, and Mark Roeloffs. Forensic data recovery from flash memory. Small Scale Digital Device Forensics Journal, 1(1):1--17, 2007.Google Scholar
- Christian Cachin, Kristiyan Haralambiev, Hsu-Chun Hsiao, and Alessandro Sorniotti. Policy-based secure deletion. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pages 259--270. ACM, 2013.Google ScholarDigital Library
- Claude Castelluccia, Emiliano De Cristofaro, Aurelien Francillon, and Mohamed-Ali Kaafar. Ephpub: Toward robust ephemeral publishing. In 2011 19th IEEE International Conference on Network Protocols, pages 165--175. IEEE, 2011.Google ScholarDigital Library
- Bo Chen, Shijie Jia, Luning Xia, and Peng Liu. Sanitizing data is not enough!: towards sanitizing structural artifacts in flash media. In Proceedings of the 32nd Annual Conference on Computer Security Applications, pages 496--507. ACM, 2016.Google ScholarDigital Library
- Bo Chen and Radu Sion. Hiflash: A history independent flash device. arXiv preprint arXiv:1511.05180, 2015.Google Scholar
- Siddharth Choudhuri and Tony Givargis. Deterministic service guarantees for nand flash using partial block cleaning. In Proceedings of the 6th IEEE/ACM/IFIP international conference on Hardware/Software codesign and system synthesis, pages 19--24. ACM, 2008.Google ScholarDigital Library
- Carnegie Mellon University. Disksim simulator. https://www.pdl.cmu.edu/DiskSim/index.shtml, 2008.Google Scholar
- Google Code. Opennfm. https://code.google.com/p/opennfm/, 2011.Google Scholar
- United States Congress. Health Insurance Portability and Accountability Act. http://www.hhs.gov/ocr/privacy/index.html, 1996.Google Scholar
- Patrick Derbez, Pierre-Alain Fouque, and Jérémy Jean. Improved key recovery attacks on reduced-round aes in the single-key setting. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 371--387. Springer, 2013.Google ScholarCross Ref
- Ming Di Leom. Remote Wiping in Android. PhD thesis, University of South Australia, 2015.Google Scholar
- Sarah Diesburg, Christopher Meyers, Mark Stanovich, Michael Mitchell, Justin Marshall, Julia Gould, An-I Andy Wang, and Geoff Kuenning. Trueerase: Per-file secure deletion for the storage data path. In Proceedings of the 28th annual computer security applications conference, pages 439--448. ACM, 2012.Google ScholarDigital Library
- Sarah Diesburg, Christopher Meyers, Mark Stanovich, An-I Andy Wang, and Geoff Kuenning. Trueerase: Leveraging an auxiliary data path for per-file secure deletion. ACM Transactions on Storage (TOS), 12(4):18, 2016.Google Scholar
- Yajuan Du, Wei Liu, Yuan Gao, and Rachata Ausavarungnirun. Observation and optimization on garbage collection of flash memories: The view in performance cliff. Micromachines, 12(7):846, 2021.Google ScholarCross Ref
- Freecode. fio. http://freecode.com/projects/fio, 2014.Google Scholar
- Simson L Garfinkel and Abhi Shelat. Remembrance of data passed: A study of disk sanitization practices. IEEE Security & Privacy, 99(1):17--27, 2003.Google ScholarDigital Library
- Roxana Geambasu, Tadayoshi Kohno, Amit A Levy, and Henry M Levy. Vanish: Increasing data privacy with self-destructing data. In USENIX Security Symposium, volume 316, 2009.Google Scholar
- Le Guan, Shijie Jia, Bo Chen, Fengwei Zhang, Bo Luo, Jingqiang Lin, Peng Liu, Xinyu Xing, and Luning Xia. Supporting transparent snapshot for bare-metal malware analysis on mobile devices. In Proceedings of the 33rd Annual Computer Security Applications Conference, pages 339--349. ACM, 2017.Google ScholarDigital Library
- Aayush Gupta, Youngjae Kim, and Bhuvan Urgaonkar. DFTL: a flash translation layer employing demand-based selective caching of page-level address mappings, volume 44. ACM, 2009.Google ScholarDigital Library
- Keonsoo Ha, Jaeyong Jeong, and Jihong Kim. A read-disturb management technique for high-density nand flash memory. In Proceedings of the 4th Asia-Pacific Workshop on Systems, page 13. ACM, 2013.Google Scholar
- J Alex Halderman, Seth D Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A Calandrino, Ariel J Feldman, Jacob Appelbaum, and Edward W Felten. Lest we remember: cold-boot attacks on encryption keys. Communications of the ACM, 52(5):91--98, 2009.Google ScholarDigital Library
- Jason D Hartline, Edwin S Hong, Alexander E Mohr, William R Pentney, and Emily C Rocke. Characterizing history independent data structures. Algorithmica, 42(1):57--74, 2005.Google ScholarDigital Library
- Md Mehedi Hasan and Biswajit Ray. Data recovery from "scrubbed" nand flash storage: Need for analog sanitiza-tion. In The 29th Usenix Security Symposium, 2020.Google Scholar
- Intel. Intel ssd firmware update tool. https://www.intel.com/content/www/us/en/download/17903/intel-ssd-firmware-update-tool.html, 2021.Google Scholar
- Kee-Hoon Jang and Tae Hee Han. Efficient garbage collection policy and block management method for nand flash memory. In 2010 2nd International Conference on Mechanical and Electronics Engineering, volume 1, pages V1--327. IEEE, 2010.Google Scholar
- Shijie Jia, Luning Xia, Bo Chen, and Peng Liu. Nfps: Adding undetectable secure deletion to flash translation layer. In Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, pages 305--315. ACM, 2016.Google ScholarDigital Library
- Shijie Jia, Luning Xia, Bo Chen, and Peng Liu. Deftl: Implementing plausibly deniable encryption in flash translation layer. In Proceedings of the 24th ACM conference on Computer and communications security. ACM, 2017.Google Scholar
- Nikolai Joukov and Erez Zadok. Adding secure deletion to your favorite file system. In Third IEEE International Security in Storage Workshop (SISW'05), pages 8--pp. IEEE, 2005.Google Scholar
- Sanghyuk Jung and Yong Ho Song. Link-gc: a preemptive approach for garbage collection in nand flash storages. In Proceedings of the 28th Annual ACM Symposium on Applied Computing, pages 1478--1484. ACM, 2013.Google ScholarDigital Library
- Keonwoo Kim, Dowon Hong, Kyoil Chung, and Jae-Cheol Ryou. Data acquisition from cell phone using logical approach. Proceedings of the world academy of science, engineering and technology, 26, 2007.Google Scholar
- Richard Kissel, Matthew A Scholl, Steven Skolochenko, and Xing Li. Sp 800--88 rev. 1. guidelines for media sanitization, 2006.Google ScholarDigital Library
- Byunghee Lee, Kyungho Son, Dongho Won, and Seungjoo Kim. Secure data deletion for usb flash memory. J. Inf. Sci. Eng., 27(3):933--952, 2011.Google Scholar
- Jaeheung Lee, Junyoung Heo, Yookun Cho, Jiman Hong, and Sung Y Shin. Secure deletion for nand flash file system. In Proceedings of the 2008 ACM symposium on Applied computing, pages 1710--1714. ACM, 2008.Google ScholarDigital Library
- Jaeheung Lee, Sangho Yi, Junyoung Heo, Hyungbae Park, Sung Y Shin, and Yookun Cho. An efficient secure deletion scheme for flash file systems. J. Inf. Sci. Eng., 26(1):27--38, 2010.Google Scholar
- Lei Lei, Quanwei Cai, Bo Chen, and Jingqiang Lin. Towards efficient re-encryption for secure client-side deduplication in public clouds. In International Conference on Information and Communications Security, pages 71--84. Springer, 2016.Google ScholarDigital Library
- Ming Di Leom, Kim-Kwang Raymond Choo, and Ray Hunt. Remote wiping and secure deletion on mobile devices: A review. Journal of forensic sciences, 61(6):1473--1492, 2016.Google Scholar
- Jingwei Li, Chuan Qin, Patrick PC Lee, and Jin Li. Rekeying for encrypted deduplication storage. In 2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 618--629. IEEE, 2016.Google ScholarCross Ref
- Jianwei Liao, Fengxiang Zhang, Li Li, and Guoqiang Xiao. Adaptive wear-leveling in flash-based memory. IEEE Computer Architecture Letters, 14(1):1--4, 2014.Google ScholarDigital Library
- Carsten Maartmann-Moe, Steffen E Thorkildsen, and André Årnes. The persistence of memory: Forensic identification and extraction of cryptographic keys. digital investigation, 6:S132--S140, 2009.Google Scholar
- Carlo Meijer and Bernard Van Gastel. Self-encrypting deception: weaknesses in the encryption of solid state drives. In 2019 IEEE Symposium on Security and Privacy (SP), pages 72--87. IEEE, 2019.Google ScholarCross Ref
- Dutch T Meyer and William J Bolosky. A study of practical deduplication. ACM Transactions on Storage (TOS), 7(4):14, 2012.Google Scholar
- Zhen Mo, Yan Qiao, and Shigang Chen. Two-party fine-grained assured deletion of outsourced data in cloud systems. In Distributed Computing Systems (ICDCS), 2014 IEEE 34th International Conference on, pages 308--317. IEEE, 2014.Google ScholarDigital Library
- Zhen Mo, Qingjun Xiao, Yian Zhou, and Shigang Chen. On deletion of outsourced data in cloud computing. In 2014 IEEE 7th International Conference on Cloud Computing, pages 344--351. IEEE, 2014.Google ScholarDigital Library
- Tilo Müller, Tobias Latzo, and Felix C Freiling. Self-encrypting disks pose self-decrypting risks. In the 29th Chaos Communinication Congress, pages 1--10, 2012.Google Scholar
- Muthukumar Murugan and David HC Du. Rejuvenator: A static wear leveling algorithm for nand flash memory with minimized overhead. In 2011 IEEE 27th Symposium on Mass Storage Systems and Technologies (MSST), pages 1--12. IEEE, 2011.Google ScholarDigital Library
- Kaan Onarlioglu, William Robertson, and Engin Kirda. Eraser: Your data won't be back. In 2018 IEEE European Symposium on Security and Privacy (EuroS&P), pages 153--166. IEEE, 2018.Google Scholar
- Radia Perlman. File system design with assured delete. In Third IEEE International Security in Storage Workshop (SISW'05), pages 6--pp. IEEE, 2005.Google Scholar
- Timothy M Peters, Mark A Gondree, and Zachary NJ Peterson. DEFY: A deniable, encrypted file system for log-structured storage. In 22th Annual Network and Distributed System Security Symposium, NDSS, 2015.Google ScholarCross Ref
- Zachary NJ Peterson, Randal C Burns, Joseph Herring, Adam Stubblefield, and Aviel D Rubin. Secure deletion for a versioning file system. In FAST, volume 5, pages 143--154, 2005.Google Scholar
- Arthur Rahumed, Henry CH Chen, Yang Tang, Patrick PC Lee, and John CS Lui. A secure cloud backup system with assured deletion and version control. In 2011 40th International Conference on Parallel Processing Workshops, pages 160--167. IEEE, 2011.Google ScholarDigital Library
- Joel Reardon, David Basin, and Srdjan Capkun. Sok: Secure data deletion. In Security and Privacy (SP), 2013 IEEE Symposium on, pages 301--315. IEEE, 2013.Google ScholarDigital Library
- Joel Reardon, Srdjan Capkun, and David Basin. Data node encrypted file system: Efficient secure deletion for flash memory. In Proceedings of the 21st USENIX conference on Security symposium, pages 17--17. USENIX Association, 2012.Google ScholarDigital Library
- Samsung. K9f4g08u0a datasheet (pdf). https://pdf1.datasheet.com/datasheet-pdf/view/135880/SAMSUNG/K9F4G08U0A.html.Google Scholar
- Samsung. Samsung ssd magician7 software. https://semiconductor.samsung.com/consumer-storage/magician/, 2022.Google Scholar
- SkyHighMemory. What types of ecc should be used on flash memory? http://www.skyhighmemory.com/download/applicationNotes/001-99200_AN99200_What_Types_of_ECC_Should_Be_Used_on_Flash_Memory.pdf.Google Scholar
- Avinash Srinivasan, Jie Wu, Panneer Santhalingam, and Jeffrey Zamanski. Deaddrop-in-a-flash: Information hiding at ssd nand flash memory physical layer. SECURWARE 2014, page 79, 2014.Google Scholar
- Mark W Storer, Kevin Greenan, Darrell DE Long, and Ethan L Miller. Secure data deduplication. In Proceedings of the 4th ACM international workshop on Storage security and survivability, pages 1--10, 2008.Google ScholarDigital Library
- Raja Subramani, Haritima Swapnil, Niharika Thakur, Bharath Radhakrishnan, and Krishnamurthy Puttaiah. Garbage collection algorithms for nand flash memory devices--an overview. In 2013 European Modelling Symposium, pages 81--86. IEEE, 2013.Google ScholarDigital Library
- Steven Swanson and Michael Wei. Safe: Fast, verifiable sanitization for ssds. San Diego, CA: University of California-San Diego, 2010.Google Scholar
- Yang Tang, Patrick PC Lee, John Lui, and Radia Perlman. Secure overlay cloud storage with access control and assured deletion. Dependable and Secure Computing, IEEE Transactions on, 9(6):903--916, 2012.Google ScholarDigital Library
- Yang Tang, Patrick PC Lee, John CS Lui, and Radia Perlman. Fade: Secure overlay cloud storage with file assured deletion. In International Conference on Security and Privacy in Communication Systems, pages 380--397. Springer, 2010.Google ScholarCross Ref
- Deepthi Tankasala, Niusen Chen, and Bo Chen. A step-by-step guideline for creating a testbed for flash memory research via lpc-h3131 and opennfm. 2020.Google Scholar
- Shin Tezuka, Ryuya Uda, and Kenichi Okada. Adec: Assured deletion and verifiable version control for cloud storage. In 2012 IEEE 26th International Conference on Advanced Information Networking and Applications, pages 23--30. IEEE, 2012.Google ScholarDigital Library
- Wei-Chen Wang, Chien-Chung Ho, Yuan-Hao Chang, Tei-Wei Kuo, and Ping-Hsien Lin. Scrubbing-aware secure deletion for 3-d nand flash. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 37(11):2790--2801, 2018.Google ScholarCross Ref
- Michael Yung Chung Wei, Laura M Grupp, Frederick E Spada, and Steven Swanson. Reliably erasing data from flash-based solid state drives. In FAST, volume 11, 2011.Google Scholar
- Jinbo Xiong, Ximeng Liu, Zhiqiang Yao, Jianfeng Ma, Qi Li, Kui Geng, and Patrick S Chen. A secure data self-destructing scheme in cloud computing. IEEE Transactions on Cloud Computing, 2(4):448--458, 2014.Google ScholarCross Ref
- Yaffs. Yaffs. http://www.yaffs.net/, 2002.Google Scholar
- Ming-Chang Yang, Yu-Ming Chang, Che-Wei Tsao, Po-Chun Huang, Yuan-Hao Chang, and Tei-Wei Kuo. Garbage collection and wear leveling for flash memory: Past and future. In Smart Computing (SMARTCOMP), 2014 International Conference on, pages 66--73. IEEE, 2014.Google ScholarCross Ref
- Apostolis Zarras, Katharina Kohls, Markus Dürmuth, and Christina Pöpper. Neuralyzer: flexible expiration times for the revocation of online data. In Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy, pages 14--25. ACM, 2016.Google ScholarDigital Library
- Lingfang Zeng, Shibin Chen, Qingsong Wei, and Dan Feng. Sedas: A self-destructing data system based on active storage framework. In APMRC, 2012 Digest, pages 1--8. IEEE, 2012.Google Scholar
- Qionglu Zhang, Shijie Jia, Bing Chang, and Bo Chen. Ensuring data confidentiality via plausibly deniable encryption and secure deletion--a survey. Cybersecurity, 1(1):1, 2018.Google ScholarCross Ref
Recommendations
Secure deletion for NAND flash file system
In most file systems, if a file is deleted, only the metadata of the file is deleted or modified and the file's data is still stored on the physical media. Some users require that deleted files no longer be accessible. This requirement is more important ...
Hot-LSNs distributing wear-leveling algorithm for flash memory
Flash memory offers attractive features, such as non-volatile, shock resistance, fast access and low power consumption for data storage. However, it has one main drawback of requiring an erase before updating the contents. Furthermore, the flash memory ...
A reliable B-tree implementation over flash memory
Flash memory has been widely used in various embedded computing systems and portable devices in recent years because of its small size, shock-resistance, low-power consumption and non-volatile properties. To hide the disadvantages of flash memory such ...
Comments