A hard drive with autonomous physical destruction function and its destruction method

Abstract

This invention relates to a hard drive with autonomous physical destruction capability and its destruction method, belonging to the field of data storage security. The hard drive includes a main control module, a storage module, a boost circuit, an energy storage module, and a switching module. Its core function is to utilize the internal boost circuit to increase the hard drive's operating voltage and store it as the high voltage required for destruction. When the main control module receives an external destruction command, it controls the switching module to apply this high voltage to the storage medium, achieving autonomous physical destruction. This invention does not require an additional high-voltage power supply from the host computer and supports automatic continuation of destruction after power failure through status recording, ensuring the reliability and integrity of the destruction process. This solution reduces system complexity, improves security and compatibility, and its hardware resources can be reused with the power-loss protection circuit, making it cost-effective.

Description

Technical Field

[0001] This invention relates to the field of data storage device security technology, specifically to a hard disk with autonomous physical destruction function and its destruction method, and more particularly to a hard disk system and control method that uses an internal boost circuit to generate high voltage to physically destroy the storage medium. Background Technology

[0002] Data storage devices, especially hard disk drives (HDDs) and solid-state drives (SSDs), require secure end-of-life handling in areas involving sensitive information. Physical destruction is a security measure that completely destroys the storage medium through irreversible physical or electrical means, making the data absolutely unrecoverable. It is widely used in military, financial, government, and high-security commercial scenarios.

[0003] Currently, a common technical solution for the physical destruction of hard drives is electrical overload destruction. This method requires the host (such as a server or security terminal) to provide the hard drive not only with a standard operating voltage (e.g., +3.3V, +5V, or +12V), but also with an additional dedicated high-voltage DC power supply (e.g., +24V or +28V) significantly higher than the operating voltage. When destruction is required, the host issues a destruction command and simultaneously applies this high voltage to a specific interface on the hard drive. The high voltage is directly or through an internal switch introduced into the hard drive's storage medium (such as NAND flash memory chips), generating a large current that burns out its internal circuitry and storage cells, thereby achieving physical destruction.

[0004] However, this existing technological solution, which relies on external high pressure, has several obvious drawbacks: 1. Increased system complexity and cost: The host unit must integrate additional high-voltage generating circuits and corresponding output interfaces, which increases the design difficulty, material costs and power system complexity of the host unit, thus restricting the popularization and application flexibility of this technology.

[0005] 2. Single point of failure risk: The execution of the entire destruction function depends entirely on whether the host can provide the high voltage. If the host's high voltage circuit fails, the interface has poor contact, or the cable is faulty, the hard drive cannot be destroyed even if the destruction command has been issued, causing the security policy to fail.

[0006] 3. Inability to handle unexpected power outages: If the entire system suddenly loses power during the physical destruction process, the destruction process is interrupted. When the system is powered back on, the destruction action depends on the host restarting and supplying high voltage, and the host usually cannot automatically recover to this state. This results in the hard drive being in an uncertain state of "partial destruction" or "destruction interruption," leaving serious data security risks.

[0007] 4. Compatibility and standardization challenges: This solution requires the hard drive interface to have high-voltage pin definitions, which is not fully compatible with existing standard interface specifications such as SATA, SAS, and NVMe. Customized interfaces and connectors are usually required, which affects the universality and replaceability of the hard drive.

[0008] Therefore, there is an urgent need in this field for a physical hard drive destruction technology that can break free from dependence on high-voltage power supplies on the host side and has higher autonomy, reliability and compatibility. Summary of the Invention

[0009] This invention designs a hard drive with autonomous physical destruction function and its destruction method. The technical problem it solves is that the existing hard drive physical destruction function requires the host to provide an additional high voltage, which makes the system complex and costly. Moreover, if there is an accidental power failure during the destruction process, it cannot automatically continue the destruction after power is restored, which poses a risk of data residue.

[0010] To solve the aforementioned technical problems, the present invention adopts the following solution: A hard drive with autonomous physical destruction capability, characterized in that it comprises: The main control module is used to receive and process external commands; A storage module, including at least one non-volatile memory chip; A voltage conversion module, whose input terminal is connected to the operating power supply of the hard drive, is used to convert the operating voltage into a destruction voltage that is higher than the operating voltage; An energy storage module is connected to the output terminal of the voltage conversion module and is used to store the electrical energy corresponding to the destruction voltage. A switch module is connected between the energy storage module and the storage module; The main control module is configured to: in response to a physical destruction command received from an external source, control the voltage conversion module to charge the energy storage module; and control the switch module to turn on, so as to apply the electrical energy stored in the energy storage module to at least a portion of the storage module, thereby achieving physical destruction.

[0011] Preferably, the voltage conversion module is a boost circuit based on an inductor boost topology or a charge pump circuit.

[0012] Preferably, the switching module includes at least one controlled power switching device; wherein the power switching device is a metal-oxide-semiconductor field-effect transistor, an insulated-gate bipolar transistor, or a relay.

[0013] Preferably, the switching module specifically includes a first field-effect transistor and a second field-effect transistor; the control electrode of the first field-effect transistor is connected to a control signal terminal of the main control module through a current-limiting resistor, and its first conducting electrode is grounded; the second field-effect transistor is a P-channel type, its first conducting electrode is connected to the high-voltage terminal of the energy storage module, its second conducting electrode is connected to the storage module as a high-voltage output terminal, and its control electrode is connected to the second conducting electrode of the first field-effect transistor; a pull-up resistor is connected between the control electrode and the first conducting electrode of the second field-effect transistor.

[0014] Preferably, the energy storage module includes at least one high-voltage capacitor.

[0015] Preferably, it further includes a state storage unit for storing a destruction status flag and destruction progress information; the main control module is further configured to: read the state storage unit when the hard disk is powered on; if the destruction status flag indicates that destruction is not complete, control the voltage conversion module to charge, and control the switching module to be turned on sequentially according to the destruction progress information, so as to apply electrical energy to the undestroyed part in the storage module in sequence until destruction is completed.

[0016] Preferably, the physical destruction command is issued by an external host by pulling a specific pin level low or high for a predetermined duration, or by a preset protocol command.

[0017] Preferably, the voltage conversion module and the energy storage module also constitute the power failure protection power supply circuit of the hard disk.

[0018] A method for destroying the aforementioned hard drive, characterized by comprising the following steps: Receiving steps: Receive a physical destruction command through the main control module; Energy storage step: In response to the physical destruction command, control the voltage conversion module to start and charge the energy storage module to the target destruction voltage; Destruction execution steps: Control the switch module to turn on, and apply the electrical energy stored in the energy storage module to at least a portion of the storage module with the destruction voltage.

[0019] Preferably, the destruction execution steps adopt a time-sharing sequential destruction strategy and include power-off recovery logic; specifically, it includes: Sub-step S1: Reading destruction progress information from the state storage unit to determine the current target to be destroyed; Sub-step S2: Controlling the switch module connected to the current target to be destroyed to be turned on, and applying the destruction voltage for a preset duration; Sub-step S3: Updating the destruction progress information and status flag in the state storage unit; Sub-step S4: If all targets have not been destroyed, return to sub-step S1; If the system loses power during the destruction process, it will automatically continue execution from sub-step S1 after power-on reset.

[0020] The hard drive with autonomous physical destruction capability and its destruction method have the following beneficial effects: (1) The present invention enables hardware autonomous destruction, reducing system complexity. By autonomously generating and storing the high voltage required for destruction through the boost circuit and energy storage element integrated inside the hard disk, it completely eliminates the dependence on the host side of the high voltage power supply, simplifies the host power supply design, and reduces the complexity and cost of the entire storage system.

[0021] (2) The present invention improves the reliability of the destruction function. The built-in destruction status management mechanism (flag bit and progress record) ensures that even if an unexpected power failure occurs during the destruction process, the hard drive can automatically identify the incomplete state after power is restored and continue to execute the destruction task, eliminating the risk of data residue caused by power failure and greatly improving the reliability and security of data destruction.

[0022] (3) The present invention enhances compatibility and applicability. It only requires the host to provide standard operating voltage and logic trigger signal (such as specific GPIO level or protocol command) to complete the destruction. It is fully compatible with existing mainstream storage interfaces (such as SATA, SAS, NVMe) and does not require customized interfaces, which significantly improves the universality and ease of use of this security function.

[0023] (4) The boost circuit and energy storage module used to generate high voltage for destruction inside the present invention can be preferentially designed as or reused as the power-loss protection (PLP) circuit of the hard disk, realizing the sharing of hardware resources. Without increasing the main cost, it simultaneously realizes the two key safety functions of power-loss data protection and physical destruction, improving the product's cost-effectiveness and competitiveness. Attached Figure Description

[0024] Figure 1 This is a system structure block diagram of a hard disk with physical destruction function provided in an embodiment of the present invention.

[0025] Figure 2 This is an example diagram of a high-voltage control switch circuit for physical destruction provided in an embodiment of the present invention. Detailed Implementation

[0026] The following is combined with Figure 1 and Figure 2 The present invention will be further described as follows: Example

[0027] This embodiment 1 provides a hard drive with autonomous physical destruction function. Its core lies in the built-in high voltage generation and control system, which enables the hard drive to autonomously and reliably complete the irreversible physical destruction of the internal storage medium by relying only on the host to provide standard working voltage and logic instructions.

[0028] Figure 1 A system architecture block diagram of the hard disk in this embodiment is shown. Figure 1 As shown, the system mainly includes: a main control module, a boost module, an energy storage module, a switching module, and a storage module. The hard drive is connected to the host through a standard interface (such as SATA, SAS, or NVMe interface), which is used to transmit data, receive the operating power supply Vcc (e.g., +5V or +12V), and the destruction trigger signal (Destroy_Trigger).

[0029] The main control module, as the core control unit of the hard drive, can be a system-on-a-chip (SoC) or a microcontroller (MCU). It is responsible for parsing host commands, managing routine read / write operations of the hard drive, and specifically integrates the destruction control logic of this invention. This logic includes: detecting destruction trigger signals, controlling the start / stop of the boost module, controlling the on / off state of the switching module, managing the destruction process (such as time-sharing), reading and writing destruction status flags and the destruction progress table in non-volatile memory, and resuming the process after power failure recovery.

[0030] The boost module's input is connected to the hard drive's operating power supply Vcc, used to boost a lower operating voltage (e.g., 5V / 12V) to a high voltage Vh (e.g., 20V to 28V) sufficient to physically break down or melt the storage medium. This module typically employs an inductor-based boost topology, and its startup and shutdown are controlled by the main control module via an enable signal (EN_Boost). The boost module's output is connected to the energy storage module to charge it.

[0031] The energy storage module mainly consists of one or more high-voltage electrolytic capacitors (such as tantalum capacitors or solid aluminum electrolytic capacitors) connected in parallel to store the high-voltage electrical energy generated by the boost module. The rated withstand voltage of the capacitors must be higher than the target charging voltage Vh with sufficient margin (e.g., if the target Vh is 24V, a capacitor with a rated voltage of 35V can be selected). The capacitor's capacitance (C) must be selected based on the energy (E) required for a single burn-in operation and the allowable voltage drop (ΔV), following the formula E ≈ 1 / 2 * C * (Vh) 2 - (Vh - ΔV) 2This is to ensure that sufficient instantaneous power can be provided.

[0032] The switching module is a controlled high-voltage switching circuit. Its high-voltage input terminal (Vin) is connected to the high-voltage terminal of the energy storage module. Its control terminal receives a destruction control signal (Ctrl_Destroy) from the main control module. Its output terminal (Vout) is connected to the target cell to be destroyed in the storage module. The main control module controls the switching module's on / off state by pulling the Ctrl_Destroy signal high or low, thereby selectively applying the high voltage Vh stored in the energy storage module to the specified storage medium.

[0033] To achieve effective physical destruction, the high-voltage output (Vout) of the switching module is connected to the power supply pin of the non-volatile memory chip (such as a NAND Flash chip) to be destroyed via printed circuit board wiring. Specifically, the destruction high voltage (Vh) is applied between the power supply (VCC / VDD) pin and the ground (VSS / GND) pin of the target chip.

[0034] In a preferred embodiment, the power networks of each memory chip or group of chips in the memory module are independent of each other and are each connected through an independent switching module channel (i.e., multiple such channels). Figure 2 The circuit shown is connected to the energy storage module. The main control module controls the Ctrl_Destroy_X signal of each channel in a time-division multiplexing manner, applying high voltage sequentially to the power network of each chip, thereby achieving safe and thorough destruction one by one, avoiding the dispersion of high voltage energy and incomplete destruction caused by the parallel connection of all chip power supplies.

[0035] Storage modules typically consist of multiple independent flash memory chips or other non-volatile memory chips. The power pins or critical data / control pins of these chips are grouped and routed to different output channels of the switching module. During physical destruction, a high voltage Vh is applied to the chip's power network or specific pins, causing permanent overload damage to the internal circuitry or memory cells of the silicon wafer.

[0036] Figure 2This diagram illustrates a specific circuit example of a switching module. Its core is a two-stage MOSFET architecture that reliably controls the high-voltage power path using low-voltage logic signals. In the diagram, a small-signal NMOS transistor (e.g., Q1, which can be a 2N7002 model) acts as a low-voltage control switch, its gate connected to the destruction control signal (Ctrl_Destroy) from the main control module via a current-limiting resistor R1. This NMOS transistor converts the low-voltage logic control signal from the main control module into a critical control action on the gate potential of the subsequent high-voltage power switch. A high-voltage PMOS transistor (e.g., Q2, which can be an AOD4185 model) serves as the core power switch, its source connected to the high-voltage output terminal (Vin) of the energy storage module, and its drain connected to the storage medium as the high-voltage output (Vout). This PMOS transistor directly controls the conduction and cutoff of the high-voltage main path. Resistor R2 acts as a pull-up resistor, connected between the gate and source of the high-voltage PMOS transistor. Its function is to ensure that when the current-stage NMOS transistor is turned off, the gate potential of the PMOS transistor is reliably pulled up to the high voltage of the source, thereby keeping it in a completely off state. This is a key design to prevent the high-voltage path from being mis-turned on and to ensure system safety. Figure 2 Optionally, a diode D1 may also be included, which can serve as a freewheeling or protection diode to discharge parasitic inductance energy in the circuit, thereby protecting the power transistor from voltage spikes. Thus, the circuit implements a complete control chain: when the main control module issues a high-level destruction command, the NMOS transistor turns on, which in turn pulls down the gate voltage of the PMOS transistor to turn it on, ultimately safely and controllably applying the high-voltage electrical energy stored in the energy storage module to the designated storage medium, completing the physical destruction function.

[0037] This example employs a two-stage MOSFET drive structure to achieve reliable control of the high-voltage path by low-voltage logic signals. Specifically, it includes: An N-channel MOSFET (Q1, such as 2N7002) is used as a low-voltage control switch. Its gate G is connected to the destruction control signal Ctrl_Destroy from the main control module through a current-limiting resistor R1. The source S is grounded.

[0038] A P-channel high-voltage MOSFET (Q2, such as AOD4185) serves as a high-voltage power switch. Its source (S) is connected to the high-voltage terminal (Vin, i.e., Vh) of the energy storage module. Its drain (D) serves as the high-voltage output (Vout), connected to the storage medium to be destroyed.

[0039] A pull-up resistor R2 is connected between the gate G and source S (i.e., the high-voltage terminal Vin) of Q2. The drain D of Q1 is connected to the gate G of Q2.

[0040] Working principle: When the main controller needs to perform a destruction operation, it sets the Ctrl_Destroy signal to a high level (e.g., 3.3V). Q1 turns on, pulling the gate of Q2 low to near ground potential. At this time, the gate-source voltage (Vgs) of Q2 is negative and its absolute value is greater than its turn-on voltage (Vth), so Q2 turns on, and the high voltage Vin can be output to Vout through Q2. When Ctrl_Destroy is low, Q1 is cut off, R2 pulls the gate of Q2 up to Vin, making Vgs ≈ 0V, Q2 is reliably turned off, and the high voltage path is cut off. Diode D1 serves as a freewheeling or protection diode and can be set according to actual needs.

[0041] The physical destruction process of the hard drive in this embodiment is as follows: Command Reception and Verification: The host sends a physical destruction command to the hard drive by pulling a specific GPIO pin low for a predetermined time (e.g., 1 second) or by sending a custom SCSI / VU command. The main control module continuously monitors this interface, and upon recognizing a valid destruction command, it enters the destruction preparation state.

[0042] High-voltage energy storage: The main control module enables the boost module (EN_Boost set high). The boost module starts working, raising the input operating voltage Vcc to the target high voltage Vh and charging the capacitor in the energy storage module. The main control can determine whether the capacitor voltage has reached the predetermined value by monitoring the feedback voltage or setting a charging timer.

[0043] Time-sharing sequential destruction: To ensure that each memory chip is subjected to sufficient high voltage for destruction and to avoid parallel short circuits, a time-sharing strategy is adopted for the destruction process. The main control module destroys each chip or chipset in the memory module sequentially according to a preset destruction schedule.

[0044] a) The main controller reads the next target to be destroyed (such as FLASH chip A) from the schedule.

[0045] b) The main controller sends a destruction control signal (Ctrl_Destroy_A high) to the switch module for target A, turns on the corresponding high voltage path, and applies high voltage Vh to the power supply network of chip A for a preset destruction time (e.g., 100 milliseconds).

[0046] c) When the destruction time is up, the main controller turns off the control signal for this channel (Ctrl_Destroy_A is set low).

[0047] d) The master controller updates the status of chip A to "destroyed" in the schedule.

[0048] e) Repeat step a and b until all target chips have been processed.

[0049] Status recording and power-off recovery: Throughout the entire destruction process, the main control module writes the current destruction progress table in real time to a dedicated, non-volatile storage area (such as the main control's internal OTP memory or a separate EEPROM) that is unaffected by the destruction process. At the same time, a global destruction flag is set.

[0050] The key improvement lies in the following: If a system power failure occurs at any stage of the time-sharing destruction process, since the destruction progress has been saved in real time, after the hard drive is powered on again, the main control module first reads the flag bit and the progress table. If it finds that the flag bit indicates "destruction in progress", the main control will not enter the normal working mode, but will directly start the boost module to charge the energy storage capacitor, and then continue to execute the time-sharing destruction process from the breakpoint recorded in the progress table until it is fully completed, and finally update the flag bit to "destroyed".

[0051] Post-destruction behavior: Once the destruction is complete, the controller sets the global flag to "destroyed". Afterward, each time the hard drive is powered on, the controller detects this flag, reports a specific error status (such as "media error" or "hardware failure") to the host, and permanently prohibits any read / write access, thus achieving a secure lock. Example

[0052] In another embodiment, some components may be replaced to simplify the design or to accommodate different cost requirements: Boost modules can use charge pump circuits instead of inductor-based boost circuits, especially when the required output current is small. Charge pumps have the advantages of simple external components and small size.

[0053] The switching module can use integrated high-voltage analog switching chips or optocoupler relays instead of discrete MOSFET circuits. Integrated solutions offer better isolation and drive consistency, and simplify PCB layout.

[0054] Energy Storage and Function Reuse: The boost module and energy storage module can be preferentially designed to serve the power loss protection (PLP) function of the hard drive. During normal operation, this circuit serves as the backup power energy storage system for the PLP. When physical destruction is required, the main controller can switch the control logic to redirect the high-voltage power of the energy storage system to the destruction path, thereby reusing hardware resources and saving costs and space.

[0055] The present invention has been described above by way of example with reference to the accompanying drawings. Obviously, the implementation of the present invention is not limited to the above-described manner. Any improvements made using the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other occasions without modification, are all within the protection scope of the present invention.

Claims

1. A hard drive with autonomous physical destruction function, characterized in that, include: The main control module is used to receive and process external commands; A storage module, including at least one non-volatile memory chip; A voltage conversion module, whose input terminal is connected to the operating power supply of the hard drive, is used to convert the operating voltage into a destruction voltage that is higher than the operating voltage; An energy storage module is connected to the output terminal of the voltage conversion module and is used to store the electrical energy corresponding to the destruction voltage. A switch module is connected between the energy storage module and the storage module; The main control module is configured to: in response to a physical destruction command received from an external source, control the voltage conversion module to charge the energy storage module; and control the switch module to turn on, so as to apply the electrical energy stored in the energy storage module to at least a portion of the storage module, thereby achieving physical destruction.

2. The hard disk according to claim 1, characterized in that: The voltage conversion module is a boost circuit or charge pump circuit based on an inductor boost topology.

3. The hard disk according to claim 1, characterized in that: The switching module includes at least one controlled power switching device; wherein the power switching device is a metal-oxide-semiconductor field-effect transistor, an insulated-gate bipolar transistor, or a relay.

4. The hard disk according to claim 3, characterized in that: The switching module specifically includes a first field-effect transistor and a second field-effect transistor; The control electrode of the first field-effect transistor is connected to a control signal terminal of the main control module through a current-limiting resistor, and its first conducting electrode is grounded. The second field-effect transistor is a P-channel type, with its first conducting terminal connected to the high-voltage terminal of the energy storage module, its second conducting terminal connected to the storage module as a high-voltage output terminal, and its control terminal connected to the second conducting terminal of the first field-effect transistor. A pull-up resistor is connected between the control electrode and the first conducting electrode of the second field-effect transistor.

5. The hard disk according to claim 1, characterized in that: The energy storage module includes at least one high-voltage capacitor.

6. The hard disk according to claim 1, characterized in that: It also includes a state storage unit for storing a destruction status flag and destruction progress information; The main control module is further configured to: read the status storage unit when the hard disk is powered on; if the destruction status flag indicates that the destruction is not complete, control the voltage conversion module to charge, and control the switching module to be turned on sequentially according to the destruction progress information, so as to apply electrical energy to the undestroyed part of the storage module in sequence until the destruction is completed.

7. The hard disk according to claim 1, characterized in that: The physical destruction command is issued by an external host by pulling a specific pin level low or high for a predetermined duration, or by a preset protocol command.

8. The hard disk according to claim 1, characterized in that: The voltage conversion module and the energy storage module also constitute the power-loss protection power supply circuit for the hard drive.

9. A method for destroying a hard disk as described in any one of claims 1 to 8, characterized in that, Includes the following steps: Receiving steps: Receive a physical destruction command through the main control module; Energy storage step: In response to the physical destruction command, control the voltage conversion module to start and charge the energy storage module to the target destruction voltage; Destruction execution steps: Control the switch module to turn on, and apply the electrical energy stored in the energy storage module to at least a portion of the storage module with the destruction voltage.

10. The destruction method according to claim 9, characterized in that: The destruction execution steps employ a time-sharing sequential destruction strategy and include power-off recovery logic; specifically, they include: Sub-step S1: Read the destruction progress information from the state storage unit to determine the current target to be destroyed; Sub-step S2: Control the switch module connected to the current target to be destroyed to be turned on, and apply the destruction voltage for a preset duration; Sub-step S3: Update the destruction progress information and status flag in the state storage unit; Sub-step S4: If all targets have not been destroyed, return to sub-step S1; if the system loses power during the destruction process, it will automatically continue from sub-step S1 after power-on reset.

Images