Remote storage device destruction

Patent metadata

Field	Value
Publication number	US-10185508-B1
Application number	US-201715422832-A
Country	US
Kind code	B1
Filing date	Feb 2, 2017
Priority date	Feb 2, 2017
Publication date	Jan 22, 2019
Grant date	Jan 22, 2019

Abstract

Technologies are provided for remotely destroying a storage device. One or more commands can be transmitted to a storage device to render the storage device inoperable. The storage device can be placed in a retired operation mode, in which the storage device cannot process data access commands. Data stored in the storage device can be sanitized to prevent it from being retrieved. Code modules that are responsible for processing data access commands can be erased from a firmware of the storage device. The storage device can perform operations to render a storage medium of the storage device inoperable. While in the retired mode, the storage device can process an inquiry command to retrieve information about the storage device from the firmware of the storage device. The retrieved information can be used to generate a digital destruction certificate that can be provided to a supplier of the storage device.

First claim

What is claimed is:

1. A system for remotely destroying a storage device, the system comprising:
a computing device comprising a processor and memory comprising computer-readable instructions that, when executed by the processor, cause the computing device to perform operations, the operations comprising:
detecting that a storage device connected to the computing device has encountered a failure condition,
transmitting a command to the storage device to make data stored in the storage device unreadable, and
transmitting a command to the storage device to enter a mode of reduced operation, in which the storage device will reject data access operations; and

the storage device, comprising a storage medium, a firmware, and a storage device controller, wherein the storage device controller is configured to:
receive the command to enter the mode of reduced operation,
update the firmware to change a mode field in the firmware to indicate that the storage device is in the mode of reduced operation,
erase a command module from the firmware to prevent the storage device controller from performing data access commands, and
disable further firmware updates for the storage device.

2. The system of claim 1 , wherein:
the computing device is further configured to transmit a command to the storage device to perform operations to render the storage medium unusable for storing data.

3. The system of claim 2 , wherein:
the storage medium is a solid state storage medium; and
the operations to render the storage medium unusable for storing data comprise repeated random access write operations that exhaust the ability of the solid state storage medium to store data.

4. The system of claim 1 , wherein the command to make the data stored in the storage device unreadable causes the data to be encrypted.

5. The system of claim 1 , further comprising:
a storage service connected to the computing device via a network connection and configured to:
receive a notification from the computing device indicating that the storage device has been remotely destroyed.

6. The system of claim 5 , wherein the storage service is further configured to schedule the storage device for physical destruction.

7. The system of claim 5 , wherein the storage service is further configured to:
transmit a request to the computing device for a digital destruction certificate for the storage device; and
receive the digital destruction certificate from the computing device.

8. A system, comprising:
a storage device, comprising a storage medium and a storage device controller, wherein the storage device controller is configured to:
determine that the storage device has encountered a failure condition;
put the storage device in a retired mode; and
generate a digital destruction certificate, wherein the digital destruction certificate indicates that the storage device is inoperable.

9. The system of claim 8 , wherein the storage device controller is further configured to, as a result of putting the storage device in the retired mode:
encrypt data stored on the storage device using a cryptographic key; and
delete the cryptographic key.

10. The system of claim 8 , wherein the storage device controller is further configured to, as a result of putting the storage device in the retired mode:
destroy the storage medium of the storage device.

11. The system of claim 8 , wherein the storage device controller is further configured to, subsequent to putting the storage device in the retired mode:
receive a command to access data stored on the storage device; and
reject the command to access the data.

12. The system of claim 8 , wherein the storage device controller is further configured to:
lock a firmware of the storage device to prevent the storage device from performing firmware updates.

13. The system of claim 8 , further comprising:
a host computer connected to the storage device, wherein the host computer comprises:
a processor; and
a memory comprising computer-readable instructions that, when executed by the processor, cause the host computer to perform operations, the operations comprising:
determining that the storage device supports remote destruction, wherein

the determining comprises inspecting a firmware of the storage device.

14. The system of claim 13 , wherein:
the operations performed by the host computer further comprise:
transmitting a reset command to the storage device to restart the storage device, and
transmitting a command to the storage device to put the storage device in the retired mode after the storage device restarts, wherein the command to put the storage device in the retired mode is encrypted by the host computer using a secret key shared between the host computer and the computing device; and

the storage device controller is further configured to:
receive the command to put the storage device in the retired mode, and
verify the command using the secret key before putting the storage device in the retired mode.

15. The method of claim 13 , wherein the storage device controller is further configured to:
transmit a notification to the host computer indicating that the storage device has been destroyed.

16. A method, comprising:
detecting a failure condition in a storage device by a host computer connected to the storage device;
transmitting a command from the host computer to the storage device to render data stored on the storage device unreadable;
transmitting a command from the host computer to the storage device to change an operational mode of the storage device to a retired mode;
updating a firmware of the storage device to disable data management; and
generating a digital destruction certificate for the storage device.

17. The method of claim 16 , further comprising:
transmitting a command from the host computer to the storage device to destroy a storage medium of the storage device.

18. The method of claim 17 , wherein:
the storage medium is a solid state storage medium; and
the command to destroy the storage medium causes repeated random access write operations that exhaust the ability of the solid state storage medium to store data.

19. The method of claim 16 , wherein updating the firmware of the storage device comprises:
deleting an operational code module from the firmware; and
disabling firmware updates for the storage device.

20. The method of claim 16 , further comprising:
transmitting an inquiry command from the host computer to the storage device; and
receiving a response at the host computer from the storage device, the response comprising the digital destruction certificate.

Assignees

• Amazon Tech Inc

Inventors

• Farhan Munif M
• Munoz Luis Padilla
• Cognata Troy

Classifications

• G06F8/654

  using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories · CPC title

• G06F3/0634

  by changing the state or mode of one or more devices · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title

• G06F3/0652

  Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket · CPC title

• G06F3/0623 Primary

  in relation to content · CPC title