Secure erase of user data using storage regions

Patent metadata

Field	Value
Publication number	US-12367300-B2
Application number	US-202117406602-A
Country	US
Kind code	B2
Filing date	Aug 19, 2021
Priority date	Aug 19, 2021
Publication date	Jul 22, 2025
Grant date	Jul 22, 2025

Abstract

Apparatuses, methods, systems, and program products are disclosed to securely erase user data using storage regions on a shared computing device. Memory stores code executable by the processor. The code is executable to configure a nonvolatile storage device of a shared device that may be used by multiple users but is exclusively used by one user at a time. The nonvolatile storage device has shared files storing system data and a data region storing user data associated with a user. The code executes to assign read-only privileges to the system region and read-write privileges to the data region before sharing the device with the user. Requests to write data to the nonvolatile storage device while the device is shared are serviced on the data region. When the user returns the shared device to the originator the code executes to erase the data region.

First claim

What is claimed is:

1. An apparatus comprising:
a processor;
a memory that stores code executable by the processor to:
configure a nonvolatile storage device of a shared device that is usable by multiple users and is exclusively used by one user at a time, the shared device retained by an originator when not used by one of the multiple users, the nonvolatile storage device comprising a system region that stores shared files for system data and a data region that stores user data associated with a user of the multiple users that is using the shared device;
assign read-only privileges to the system region and read-write privileges to the data region prior to sharing the shared device with the user;
redirect write operations for a program from the system region to user data such that requests to write data to the nonvolatile storage device while the device is shared are serviced on the data region;
track the write operations in a log file that is stored in the data region;
detect connection of an external nonvolatile storage device to the shared device, the external nonvolatile storage device comprising an initial copy of user data and applications that are useable on a plurality of shared devices with different configurations;
identify user data and applications on the external nonvolatile storage device that are useable on the shared device based on a configuration of the shared device;
make the identified user data and applications on the external nonvolatile storage device accessible to the user on the shared device while hiding user data on the external nonvolatile storage device that is not useable on the shared device; and
in response to the shared device being returned to the originator:
copy the log file that is stored in the data region to the external nonvolatile storage device;
erase the data region; and
write the initial copy of user data and applications from the external nonvolatile storage device to the data region.

2. The apparatus of claim 1 , wherein the code is executable by the processor to allocate storage for user software applications and files on the data region.

3. The apparatus of claim 1 , wherein the code is executable by the processor to forward write instructions generated by the operating system, a firmware, or a user to the data region in response to a write instruction stored within the system region.

4. The apparatus of claim 1 , wherein the data region is an external nonvolatile storage device that is selectively connected to the nonvolatile storage device of the system region and wherein the separate nonvolatile storage device of the data region is separated from the shared device and retained by the user when the user returns the shared device to the originator.

5. The apparatus of claim 4 , wherein the code is executable by the processor to install an application on the shared device in the data region of the external nonvolatile storage device, and wherein the data region is transferred to a second computing device such that the second computing device runs the application installed in the data region of the external nonvolatile storage device.

6. The apparatus of claim 1 , wherein the code is executable by the processor to display to the user that the data region has been successfully erased.

7. The apparatus of claim 1 , wherein:
in response to the shared device being used by a user of the multiple users, the code is executable by the processor to track write instructions to the data region in the log file while the system region operates with read privileges and the data region operates with read-write privileges; and
in response to the shared device being returned to the originator, the code is executable by the processor to operate the system region and the data region with read-write privileges.

8. The apparatus of claim 7 , wherein, in response to the shared device being used by a user of the multiple users:
the code is executable by the processor to write the initial copy of user data and applications to the external nonvolatile storage device, and write the log file in the data region comprising each write instruction; and
in response to the shared device being returned to the originator, the code is executable by the processor to copy the log file in the data region to the external nonvolatile storage device, erase the data region, and write the initial copy of user data and applications to the data region.

9. The apparatus of claim 7 , wherein, in response to the shared device being returned to the originator, the code is executable by the processor to write a copy of the operating system and the firmware to the external nonvolatile storage device and write an update to at least one of the firmware and the operating system on the system region.

10. The apparatus of claim 9 , wherein the system region and the data region are on a single integrated nonvolatile storage device, and the system region uses a log file to erase data written on the data region while the user uses the shared device.

11. A method of sharing a computer comprising:
configuring a nonvolatile storage device of a shared device to be usable by multiple users and exclusively used by one user at a time, the shared device retained by an originator when not used by one of the multiple users, the nonvolatile storage device comprising a system region that stores shared files for system data and a data region that stores user data associated with a user of the multiple users that is using the shared device;
assigning read-only privileges to the system region and read-write privileges to the data region prior to sharing the shared device with the user;
redirecting write operations for a program from the system region to user data such that requests to write data to the nonvolatile storage device while the device is shared are serviced on the data region;
tracking the write operations in a log file that is stored in the data region;
detecting connection of an external nonvolatile storage device to the shared device, the external nonvolatile storage device comprising an initial copy of user data and applications that are useable on a plurality of shared devices with different configurations;
identifying user data and applications on the external nonvolatile storage device that are useable on the shared device based on a configuration of the shared device;
making the identified user data and applications on the external nonvolatile storage device accessible to the user on the shared device while hiding user data on the external nonvolatile storage device that is not useable on the shared device; and
in response to the shared device being returned to the originator:
copying the log file that is stored in the data region to the external nonvolatile storage device;
erasing the data region; and
writing the initial copy of user data and applications from the external nonvolatile storage device to the data region.

12. The method of claim 11 , further comprising allocating memory for user software applications and files on the data region.

13. The method of claim 11 , further comprising forwarding all write instructions of the operating system, a firmware, or a user to the data region in response to a write instruction within the system region.

14. The method of claim 11 , further comprising separating the data region from the nonvolatile memory device of the system region; wherein:
the data region is an external nonvolatile memory device from the system region; and
the external nonvolatile memory device of the data region is selectively connected to the system region and retained by the user when the user

Assignees

• Lenovo Singapore Pte Ltd

Inventors

• Nicholson John W
• Cromer Daryl C
• Locker Howard
• Wang Mengnan

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F3/0644

  Management of space entities, e.g. partitions, extents, pools · CPC title

• G06F3/0652

  Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket · CPC title

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title