Solid-state drive data security enhancement

Patent metadata

Field	Value
Publication number	US-9501242-B2
Application number	US-201514606078-A
Country	US
Kind code	B2
Filing date	Jan 27, 2015
Priority date	Jan 28, 2014
Publication date	Nov 22, 2016
Grant date	Nov 22, 2016

Abstract

Embodiments of the present disclosure provide a method and apparatus for storage control. The method comprises: in response to having received a data deletion command on sensitive data, marking a storage medium page where the sensitive data is located as invalid, and putting a storage medium block where the storage medium page is located in a garbage collection queue, wherein the storage medium block is a minimum unit of storage medium erasure in a SSD; determining a secure deletion time corresponding to the sensitive data; in response to a remaining time to a next garbage collection being longer than the secure deletion time corresponding to the sensitive data, setting a value of the remaining time as the secure deletion time; and triggering a garbage collection according to the remaining time. Using the solution according to the embodiment of the present disclosure, the security of the SSD can be enhanced.

First claim

What is claimed is:

1. A method for data storage control, comprising:
in response to having received a data deletion command for sensitive data, marking a storage medium page where the sensitive data is located as invalid, and putting a storage medium block where the storage medium page is located in a garbage collection queue, wherein the storage medium block is a minimum unit of storage medium erasure in SSD;
determining a secure deletion time corresponding to the sensitive data;
in response to a remaining time to a next garbage collection being longer than the secure deletion time corresponding to the sensitive data, setting a value of the remaining time as the secure deletion time; and
triggering a garbage collection according to the remaining time.

2. The method of claim 1 , further comprising:
receiving a data write command, the data write command comprising data, and the data write command indicating whether the data is sensitive data; and
in response to the data being sensitive data, storing the data in a storage medium block dedicated to storing sensitive data, wherein the storage medium block dedicated to storing sensitive data includes no valid storage medium page used for storing non-sensitive data.

3. The method of claim 1 , wherein the secure deletion time is set when deleting the sensitive data.

4. The method of claim 1 , wherein the secure deletion time is set when writing the sensitive data.

5. The method of claim 1 , wherein different modules are used to respectively process sensitive data and non-sensitive data.

6. An apparatus for storage control, comprising:
a storage medium block processing module configured to, in response to having received a data deletion command on sensitive data, mark a storage medium page where the sensitive data is located as invalid, and put a storage medium block where the storage medium page is located in a garbage collection queue, wherein the storage medium block is a minimum unit of storage medium erasure in SSD;
a secure deletion time determining module configured to determine a secure deletion time corresponding to the sensitive data;
a remaining time setting module configured to, in response to a remaining time to a next garbage collection being longer than the secure deletion time corresponding to the sensitive data, set a value of the remaining time as the secure deletion time; and
a triggering module configured to trigger a garbage collection according to the remaining time.

7. The apparatus of claim 6 , further comprising:
a write command receiving module configured to receive a data write command, the data write command comprising data, and the data write command indicating whether the data is sensitive data; and
a data storing module configured to, in response to the data being sensitive data, store the data in a storage medium block dedicated to storing sensitive data, wherein the storage medium block dedicated to storing sensitive data includes no valid storage medium page used for storing non-sensitive data.

8. The apparatus of claim 6 , wherein the secure deletion time is set when deleting the sensitive data.

9. The apparatus of claim 6 , wherein the secure deletion time is set when writing the sensitive data.

10. The apparatus of claim 6 , wherein different modules are used to respectively process sensitive data and non-sensitive data.

11. A computer program product for data storage control, the computer program product comprising a non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processing circuits to cause the one or more processing circuits to perform a method comprising:
in response to having received a data deletion command for sensitive data, marking a storage medium page where the sensitive data is located as invalid, and putting a storage medium block where the storage medium page is located in a garbage collection queue, wherein the storage medium block is a minimum unit of storage medium erasure in SSD;
determining a secure deletion time corresponding to the sensitive data;
in response to a remaining time to a next garbage collection being longer than the secure deletion time corresponding to the sensitive data, setting a value of the remaining time as the secure deletion time; and
triggering a garbage collection according to the remaining time.

12. The computer program product of claim 11 , wherein the program instructions are executable to further cause the one or more processor circuits to:
receive a data write command, the data write command comprising data, and the data write command indicating whether the data is sensitive data; and
in response to the data being sensitive data, store the data in a storage medium block dedicated to storing sensitive data, wherein the storage medium block dedicated to storing sensitive data includes no valid storage medium page used for storing non-sensitive data.

13. The computer program product of claim 11 , wherein the program instructions are executable to further cause the one or more processor circuits to set the secure deletion time when deleting the sensitive data.

14. The computer program product of claim 11 , wherein the program instructions are executable to further cause the one or more processor circuits to set the secure deletion time when writing the sensitive data.

15. The computer program product of claim 11 , wherein the program instructions are executable to further cause the one or more processor circuits to use different modules to respectively process sensitive data and non-sensitive data.

Assignees

• IBM

Inventors

• Shi yong hong
• Su Qian
• Sun Yu
• You Wei

Classifications

• G06F3/0679

  Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP] · CPC title

• G06F3/0652 Primary

  Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F3/0623

  in relation to content · CPC title

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title