1. Work-in-Progress: Full-Datapath Secure Deletion
Sarah Diesburg, Chris Meyers,
An-I Andy Wang
USENIX Security ‘09

2. Full-Datapath Secure Deletion
Current Work
Secure deletion
Erasing all traces of files after user deletion
The problem
Fine-grained secure deletion methods only operate on one segment of storage data path
Secure deletion may leave traces of data when interacting with other components (e.g. journal, page cache, flash)
The solution
Develop holistic, data-path-wide approach to securely erase files
Full-Datapath Secure Deletion

3. When is fine-grained secure deletion important?
Getting rid of one personal file
Switching banks, hospitals, any large organization
Decommissioned hard drives
Military purposes
Full-Datapath Secure Deletion

4. Are current methods good enough?
Applications
Applications cannot delete information about files
File
System
Block
Layer
Storage
Full-Datapath Secure Deletion

5. Are current methods good enough?
Applications
Applications cannot delete information about files
File systems may
Hold hidden copies of information
Consolidate writes
Not honor in-place overwrites
File
System
Block
Layer
Storage
Full-Datapath Secure Deletion

6. Are current methods good enough?
Applications
Applications cannot delete information about files
File systems may
Hold hidden copies of information
Consolidate writes
Not honor in-place overwrites
Some storage media do not honor in-place overwrites
File
System
Block
Layer
Storage
Full-Datapath Secure Deletion

7. Full-Datapath Secure Deletion
Centralized module that passes secure deletion information from file system to lower layers
Extension to storage block layer to take advantage of above information
Issue secure overwrite command
Call storage-specific secure deletion command
Full-Datapath Secure Deletion

8. Full-Datapath Secure Deletion
Applications
User
Kernel
Page Cache
File System
Add
Secure Deletion Module
After cache!
Check
Block #
Block
Layer
Block #
Secure delete commands
Storage
Full-Datapath Secure Deletion

9. Full-Datapath Secure Deletion
Approach Advantages
Irrevocably deletes data and description information
Easy to use
User calls normal delete commands
Per-file deletion
Acceptable performance
Behaves correctly during failures
Soft-state module and conservative recovery
Works with modern file system mechanisms
Journaling, page cache, compression, etc.
Works with emerging solid-state storage media
Compatible beside the legacy storage data path
No modification to original behavior
Full-Datapath Secure Deletion

10. Full-Datapath Secure Deletion
Current Development
Implements both secure write and secure delete block layer commands
Secure write useful for devices that do not honor in-place overwrites
Linux kernel with ext3 and NAND flash
Full-Datapath Secure Deletion

11. Full-Datapath Secure Deletion
Questions?
Full-Datapath Secure Deletion