Disk sanitization using encryption

• US 7,581,118 B2
• Filed: 12/05/2005
• Issued: 08/25/2009
• Est. Priority Date: 12/14/2004
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: McGovern, William P.
• Primary Examiner(s): Moazzami; Nasser G
• Assistant Examiner(s): POGMORE, TRAVIS D
• Application Number:
  US11/295,214
• Publication Number:
  US 20060143476A1
• Time in Patent Office: 1,359 Days
• Field of Search: 713/165, 713/191, 713/193, 380/59
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00507 wherein consecutive physical data units of the record carrier are encrypted with separate encryption keys, e.g. the key changes on a cluster or sector basis
• CPC Class Codes: G11B 20/00666 involving a step of erasing or nullifying data, e.g. data being overwritten with a random string
• CPC Class Codes: G11B 20/00673 wherein the erased or nullified data include a cryptographic key
• CPC Class Codes: G11B 20/00695 said measures preventing that data are read from the recording medium
• CPC Class Codes: G11B 20/10 Digital recording or reproducing

Abstract

A technique for sanitizing data storage devices, such as magnetic disks, is disclosed. Logical data storage units such as files or portions thereof may be individually deleted and sanitized on a disk. A disk is divided into physical disk regions, each comprising one or more blocks. The contents of the disk are encrypted using a separate encryption key for each physical disk region. If a file or other data structure located in a first disk region and encrypted using a first encryption key is to be deleted, the logical portions (i.e., blocks) of that region that do not belong to the file are re-encrypted using a second encryption key, and the first encryption key is deleted.

Claims

1. A method of disk sanitization comprising:

encrypting data stored on a disk, including a set of blocks, by using a first encryption key; and

in response to a request to delete the set of blocks,

re-encrypting blocks stored on the disk other than the set of blocks, by using a second encryption key, and not re-encrypting the set of blocks; and

deleting the first encryption key.

2. The method of claim 1, wherein the disk comprises a plurality of regions, and wherein said encrypting data stored on the disk comprises encrypting each of the plurality of regions with a different encryption key.

3. The method of claim 1, wherein deleting the first encryption key comprises:

overwriting the first encryption key.

4. The method of claim 3, wherein overwriting the first encryption key comprises:

overwriting a portion of a cryptographic key database including the first encryption key, wherein the cryptographic key database is encrypted using a master key.

5. The method of claim 1, wherein re-encrypting blocks stored on the disk other than the set of blocks comprises using a cryptographic module.

6. The method of claim 1, wherein the set of blocks comprises a file.

7. The method of claim 1, wherein re-encrypting blocks stored on the disk other than the set of blocks comprises:

decrypting blocks stored on the disk other than the set of blocks, by using the first encryption key; and

encrypting the blocks stored on the disk other than the set of blocks, by using the second encryption key.

8. The method of claim 1, further comprising marking the set of blocks so that the first disk region may be overwritten.

9. The method of claim 1, wherein the set of blocks represents a file.

10. The method of claim 1, wherein the set of blocks represents a portion of a file.

11. A system to perform disk sanitization, the system comprising:

a disk including data encrypted using a first encryption key; and

a processor configured to respond to a command to delete a first set of encrypted blocks on the disk, the first set of encrypted blocks representing a file or a portion thereof, by;

decrypting blocks on the disk other than the first set of encrypted blocks,

using a second encryption key to re-encrypt the blocks on the disk other than the first set of encrypted blocks, and not decrypting the first set of encrypted blocks, and

deleting the first encryption key.

12. The system of claim 11, wherein the disk comprises a plurality of regions, and wherein the processor is further configured to encrypt data stored on the disk by encrypting each of the plurality of regions with a different encryption key, and wherein the first set of blocks is contained within a single region of the plurality of regions.

13. The system of claim 11, wherein the processor is at least part of a cryptographic module.

14. The system of claim 11, wherein the first and second cryptographic keys are stored in a cryptographic key database on the disk.

15. The system of claim 14, wherein the processor deletes the first encryption key by performing a media overwrite of the first encryption key.

16. The system of claim 15, wherein the media overwrite is a single pass overwrite.

17. The system of claim 14, wherein the cryptographic database is encrypted using a master key.

18. The system of claim 17, wherein the master key is accessible to the cryptographic module.

19. A method for performing media sanitization of a disk that includes a plurality of regions, the method comprising:

encrypting data on the disk by using a different encryption key to encrypt each of the plurality of regions, the data on the disk including a file, wherein said encrypting includes encrypting the file using a first encryption key;

storing the first encryption key in a cryptographic key database;

receiving a command to delete the file; and

in response to the command to delete the file,

identifying a first set of blocks on the disk which belong to the file and a second set of blocks on the disk which do not belong to the file;

re-encrypting the second set of blocks by using a second encryption key and not re-encrypting the first set of blocks; and

deleting the first encryption key by overwriting a portion of the cryptographic key database corresponding to the first encryption key.

20. The method of claim 19, further comprising:

encrypting the cryptographic key database using a master key.

21. The method of claim 19, further comprising:

marking the first set of blocks so that the first set of blocks may be overwritten.