SECURE ERASURE OF DATA FROM A NON-VOLATILE MEMORY

• US 20120278564A1
• Filed: 04/29/2011
• Published: 11/01/2012
• Est. Priority Date: 04/29/2011
• Status: Active Grant

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Goss, Ryan James, Seekins, David Scott, Haines, Jonathan W., Feldman, Timothy R.
• Granted Patent: US 8,909,888 B2
• Time in Patent Office: Days
• US Class Current: 711/155
• CPC Class Codes: G06F 12/00 Accessing, addressing or allocating within memory systems or architectures digital input from, or digital output to record carriers, e.g. to disk storage units, G06F3/06
• CPC Class Codes: G06F 12/0253 Garbage collection, i.e. reclamation of unreferenced memory

Abstract

Method and apparatus for securely erasing data from a non-volatile memory, such as but not limited to a flash memory array. In accordance with various embodiments, an extended data set to be sanitized from the memory is identified. The extended data set includes multiple copies of data having a common logical address and different physical addresses within the memory. The extended data set is sanitized in relation to a characterization of the data set. The data sanitizing operation results in the extended data set being purged from the memory and other previously stored data in the memory being retained.

Claims

1. A method comprising:

identifying an extended data set to be sanitized from a non-volatile memory, the extended data set comprising multiple copies of data having a common logical address stored in different physical addresses within the memory; and

sanitizing the multiple copies of data of the extended data set from the memory in relation to a characterization of the data set so that other previously stored data in the memory are retained in the memory.

2. The method of claim 1, in which the sanitizing step comprises performing a first type of sanitizing operation upon the extended data set responsive to the set having a first characterization, and performing a different, second type of sanitizing operation upon the extended data set responsive to the set having a different, second characterization.

3. The method of claim 1, in which the identifying step comprises determining an overall size of the extended data set as a total accumulated amount of data associated therewith, performing a first type of sanitizing operation upon the data set responsive to said overall size exceeding a selected threshold, and performing a different, second type of sanitizing operation upon the data set responsive to said overall size being below the selected threshold.

4. The method of claim 3, further comprising comparing the overall size of the extended data set to a lower, second selected threshold, and performing a different, third type of sanitizing operation upon the data set responsive to overall size being below the second selected threshold.

5. The method of claim 1, in which the sanitizing operation comprises destroying an encryption key used to encrypt at least a portion of the extended data set prior to storage thereof in the memory.

6. The method of claim 1, in which the sanitizing operation comprises performing a garbage collection operation upon at least one erasure block of the memory, the garbage collection operation comprising an erasure of the at least one erasure block.

7. The method of claim 1, in which the sanitizing operation comprises overwriting memory cells in the memory which store data bits of the extended data set.

8. The method of claim 1, in which the sanitizing operation removes at least one older copy of data in the extended data set and retains a most current copy of data in the extended data set.

9. The method of claim 1, in which the extended data set includes a first copy of data in a first garbage collection unit (GCU) of the memory and a second copy of the data in a different, second GCU of the memory, and the identifying step comprises referencing respective GCU sequence values stored in the first and second GCUs to identify the extended data set.

10. The method of claim 1, in which the sanitizing step comprises selecting a sanitizing operation for the extended data set in relation to a cost associated with the selected sanitizing operation.

11. The method of claim 1, in which the sanitizing operation is characterized as a non-destructive purge of the extended data set so that the physical memory locations in which the extended data set were stored can be subsequently used to store new data.

12. The method of claim 1, in which the sanitizing operation is characterized as a destructive purge of the extended data set so that at least some of the physical memory locations in which the extended data set were stored are damaged so as to be incapable of subsequently storing new data.

13. An apparatus comprising:

a non-volatile memory which stores an extended data set comprising multiple copies of data having a common logical address and different physical addresses within the memory; and

a controller adapted to characterize the extended data set and to sanitize the extended data set from the memory responsive to said characterization so that the extended data set is non-destructively purged from the memory and other data in the memory are retained, wherein a first type of sanitizing operation is carried out responsive to a first characterization of the extended data set and a different, second type of sanitizing operation is carried out responsive to a different, second characterization of the extended data set.

14. The apparatus of claim 13, in which the multiple copies of the data in the extended data set comprise a most current copy of the data stored in a first physical location and an older, stale version of the data stored in a different, second physical location of the memory.

15. The apparatus of claim 14, in which the controller sanitizes the older, stale version of the data from the second physical location and retains the most current copy of the data in the first physical location.

16. The apparatus of claim 13, further comprising a monitor circuit coupled to the controller which generates an internal trigger to commence the sanitizing operation upon the extended data set.

17. The apparatus of claim 16, in which the monitor circuit generates the internal trigger responsive to the number of said multiple copies of the data reaching a predetermined threshold.

18. The apparatus of claim 13, in which the memory is arranged as a plurality of garbage collection units (GCU) each allocated and erased as a unit, each GCU storing a GCU sequence value indicative of an allocation order of the GCUs, the controller referencing the GCU sequence values to identify the physical locations of the multiple copies of the data forming the extended data set.

19. The apparatus of claim 13, in which the different first and second sanitizing operations are each selected from a group comprising a garbage collection operation upon the entire memory, a garbage collection operation limited to a portion of the memory, a destruction of an encryption key used to encrypt at least a portion of the extended data set, a data overwrite operation so that at least one data bit of the extended data set is overwritten, or a data overwrite/erasure cycle.

20. A storage device comprising a non-volatile memory, a monitor circuit, and a controller adapted to, responsive to a trigger signal generated by the monitor circuit, sanitize an extended data set from the non-volatile memory responsive to an overall size of the data set, the data set comprising multiple copies of host data sharing a common logical address and having different physical addresses within the memory, said sanitizing operable to purge the extended data set from the memory while retaining other host data in the memory.

21. The storage device of claim 20, in which the monitor circuit generates the trigger signal responsive to said multiple copies of the data reaching a predetermined threshold.

22. The storage device of claim 20, in which the controller applies a first data sanitizing operation to the memory responsive to the overall size exceeding a predetermined threshold, the controller applying a different, second data sanitizing operation to the memory responsive to the overall size not exceeding the predetermined threshold.

23. The storage device of claim 20, in which the sanitizing operation carried out by the controller is characterized as a non-destructive purge of the extended data set so that the physical memory locations in which the extended data set were stored can be subsequently used to store new data.

24. The storage device of claim 20, in which the sanitizing operation is characterized as a destructive purge of the extended data set so that at least some of the physical memory locations in which the extended data set were stored are damaged so as to be incapable of subsequently storing new data.

25. The storage device of claim 20, in which the controller is further adapted to perform a search operation upon the memory to identify physical locations of said multiple copies.