Disk sanitization in an active file system

• US 7,526,620 B1
• Filed: 09/14/2005
• Issued: 04/28/2009
• Est. Priority Date: 12/14/2004
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: McGovern, William P.
• Primary Examiner(s): Sough; Hyung S
• Assistant Examiner(s): Ahmed; Hamdy S
• Application Number:
  US11/227,813
• Time in Patent Office: 1,322 Days
• Field of Search: 711/159
• US Class Current: 711/159
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen

Abstract

A method of sanitizing storage in a data storage system includes maintaining data in an active file system, and automatically sanitizing the data in the active file system according to a specified scheduling criterion.

Claims

1. A method for sanitizing storage in a data storage system, the method comprising:

maintaining a queue of pointers pointing to a plurality of data storage units in a physical storage facility, wherein each of the plurality of data storage units contains data deemed discarded in an active file system; and

automatically sanitizing the plurality of data storage units according to a specified scheduling criterion, wherein said sanitizing is performed by overwriting the data on the plurality of data storage units and causing the data to be unrecoverable from the physical storage facility, and wherein the active file system remains accessible for non-sanitization operations during said sanitizing.

2. The method of claim 1, wherein said automatically sanitizing the plurality of storage units is performed by a component of the active file system.

3. The method of claim 1, further comprising:

making a data storage unit of the plurality of data storage units unavailable to a host processor until the data storage unit is overwritten.

4. The method of claim 1, wherein the overwriting comprises overwriting the plurality of data storage units multiple times.

5. The method of claim 1, wherein the specified scheduling criterion is dynamic.

6. The method of claim 5, further comprising:

determining the specified scheduling criterion based on available system resources.

7. The method of claim 5, further comprising:

increasing a number of data storage units sanitized per unit time when the available system resources increase; and

decreasing the number of data storage units sanitized per unit time when the available system resources decrease.

8. The method of claim 1, wherein maintaining a queue of pointers comprises maintaining a queue file.

9. The method of claim 8, further comprising:

adding new data storage units corresponding to a deleted file to the queue file when the deleted file is deleted.

10. The method of claim 1, further comprising:

receiving a command to delete a user file including a set of data storage units; and

allocating the data storage units to the queue until the data storage units are sanitized.

11. A storage system comprising:

an active file system;

a queue of pointers pointing to a plurality of data storage units in a physical storage facility, wherein each of the plurality of data storage units contains data deemed discarded in the active file system; and

a processor coupled with the physical storage facility, to receive a command to alter a logical storage unit including a set of data storage units maintained by the active file system of the storage system, and in response to the command, to allocate the set of data storage units to the queue, and to sanitize the plurality of data storage units according to a specified scheduling criterion, wherein the sanitization is performed by overwriting the data on the data storage units and causing the data to be unrecoverable from the physical storage facility, and wherein the active file system remains accessible for non-sanitization operations during said sanitization.

12. The storage system of claim 11, wherein the specified scheduling criterion is user configurable.

13. The storage system of claim 11, wherein the specified scheduling criterion is dynamic.

14. The storage system of claim 13, wherein the specified scheduling criterion is based on available system resources.

15. The storage system of claim 14, wherein the processor increases a rate of sanitization when the available system resources exceed a top threshold, and wherein the processor decreases the rate of sanitization when the available system resources are below a bottom threshold.

16. The storage system of claim 11, wherein the specified scheduling criterion depends on a size of the queue.

17. The storage system of claim 11, wherein the queue is a file.

18. The storage system of claim 17, wherein the data storage units are blocks.

19. The system of claim 11, wherein the processor sanitizes the queue using multiple overwrite sanitization.

20. The storage system of claim 11, wherein the data storage units of the queue are unavailable.

21. A method for sanitizing storage, the method comprising:

receiving a command to alter a file;

reallocating a set of blocks comprising the file to a queue file and altering the file according to the command, wherein the queue file comprises a queue of pointers pointing to the set of blocks;

making the set of blocks unavailable to processes other than sanitization; and

sanitizing the set of blocks in the queue file according to a specified scheduling criterion, wherein said sanitizing is performed by overwriting data on the set of blocks and causing the data to be unrecoverable, and wherein an active file system remains accessible for non-sanitization operations during said sanitizing.

22. The method of claim 21, wherein said sanitizing comprises automatically sanitizing the set of blocks in the active file system.

23. The method of claim 22, wherein the sanitizing is a background process, such that the active file system remains accessible to a user during said sanitizing.

24. The method of claim 22, wherein said automatically sanitizing the data in the active file system is performed by a component of the active file system.

25. The method of claim 21, further comprising:

setting the specified scheduling criterion in response to a user selection.

26. The method of claim 21, wherein the specified scheduling criterion is dynamic.

27. The method of claim 26, further comprising:

varying a rate of sanitization based on available system resources.