Work-in-Progress: Full-Datapath Secure Deletion Sarah Diesburg, Chris Meyers, An-I Andy Wang USENIX Security ‘09

Full-Datapath Secure Deletion Current Work Secure deletion Erasing all traces of files after user deletion The problem Fine-grained secure deletion methods only operate on one segment of storage data path Secure deletion may leave traces of data when interacting with other components (e.g. journal, page cache, flash) The solution Develop holistic, data-path-wide approach to securely erase files Full-Datapath Secure Deletion

When is fine-grained secure deletion important? Getting rid of one personal file Switching banks, hospitals, any large organization Decommissioned hard drives Military purposes Full-Datapath Secure Deletion

Are current methods good enough? Applications Applications cannot delete information about files File System Block Layer Storage Full-Datapath Secure Deletion

Are current methods good enough? Applications Applications cannot delete information about files File systems may Hold hidden copies of information Consolidate writes Not honor in-place overwrites File System Block Layer Storage Full-Datapath Secure Deletion

Are current methods good enough? Applications Applications cannot delete information about files File systems may Hold hidden copies of information Consolidate writes Not honor in-place overwrites Some storage media do not honor in-place overwrites File System Block Layer Storage Full-Datapath Secure Deletion

Full-Datapath Secure Deletion Centralized module that passes secure deletion information from file system to lower layers Extension to storage block layer to take advantage of above information Issue secure overwrite command Call storage-specific secure deletion command Full-Datapath Secure Deletion

Full-Datapath Secure Deletion Applications User Kernel Page Cache File System Add Secure Deletion Module After cache! Check Block # Block Layer Block # Secure delete commands Storage Full-Datapath Secure Deletion

Full-Datapath Secure Deletion Approach Advantages Irrevocably deletes data and description information Easy to use User calls normal delete commands Per-file deletion Acceptable performance Behaves correctly during failures Soft-state module and conservative recovery Works with modern file system mechanisms Journaling, page cache, compression, etc. Works with emerging solid-state storage media Compatible beside the legacy storage data path No modification to original behavior Full-Datapath Secure Deletion

Full-Datapath Secure Deletion Current Development Implements both secure write and secure delete block layer commands Secure write useful for devices that do not honor in-place overwrites Linux 2.6.25.6 kernel with ext3 and NAND flash Full-Datapath Secure Deletion

Full-Datapath Secure Deletion Questions? Full-Datapath Secure Deletion