A method and system for securely erasing cloud-based training data

Abstract

This invention relates to the fields of data security and cloud computing technology, specifically to a method and system for securely erasing cloud-based training data. The method includes: obtaining the identifier of the target NVMe solid-state drive, isolating it from the resource pool and marking it as unwritable; after confirming that the training data meets the deletion conditions, sending a notification to the tenant and obtaining electronic signature authorization; sending batch query commands to detect hardware erasure capabilities and dynamically generating erasure strategies; executing multiple rounds of secure erasure; performing multi-point sampling verification and deep random verification; generating a digital certificate and compliance report after successful verification, and updating the device status to destroyed. This invention achieves a traceable authorization process, utilizes hardware erasure to solve data residue caused by wear leveling, combines multi-round erasure with dual verification to improve reliability, generates verifiable destruction credentials, and meets the requirements for full lifecycle management of training data.

Description

Technical Field

[0001] This invention relates to the fields of data security and cloud computing technology, specifically to a method and system for securely erasing cloud-based training data. Background Technology

[0002] With the deep integration of cloud computing and artificial intelligence technologies, more and more enterprises and research institutions are storing massive amounts of machine learning training data on NVMe solid-state drives in the cloud and using cloud computing power to accelerate model iteration. This type of training data often involves highly sensitive information such as user privacy, trade secrets, and intellectual property. In the traditional "data local storage, cloud computing power supply" storage-compute separation architecture, customer business data is usually stored in local private clouds or data centers. In order to utilize cloud GPUs for large-scale training, this data must be transmitted to cloud computing nodes through secure channels such as dedicated lines.

[0003] In typical virtual machine or physical machine deployment scenarios, business data, intermediate results, checkpoint files, and log information during the training process may be intentionally or unintentionally written to the cloud service provider's local hard drive. To reduce the risk of data residue, the industry currently mainly uses software overwriting (such as full disk write 0 or write 1 operations) to overwrite the original data through multiple writes, thereby reducing the possibility of data recovery.

[0004] While the aforementioned existing technologies have mitigated the risk of data leakage to some extent, they still have the following significant drawbacks in real-world cloud environments: 1) The wear leveling mechanism of NVMe solid-state drives may cause the overwrite command initiated by the operating system to be mapped to different physical storage blocks, resulting in training data remaining in a hidden area that is not visible to the user. Simple full disk write 0 or write 1 operations cannot ensure that all training data is completely erased, thus creating a risk that the training data can be recovered. 2) When multiple tenants share the same physical device, if the training data of the previous tenant is not completely destroyed, it may be maliciously recovered by the subsequent tenant, which may lead to the theft of cross-tenant data and cause serious data leakage incidents. 3) Existing cloud storage management tools fail to fully utilize the built-in Sanitize hardware-level erase command of NVMe solid-state drives, lacking an automatic detection and invocation mechanism for hardware erase capabilities, resulting in idle hardware-level secure erase capabilities and the inability to achieve truly physical-level irreversible data destruction; 4) In the existing technology, cloud service providers cannot provide customers with auditable and verifiable data destruction certificates, and lack a systematic mechanism for verifying erasure results, which makes it impossible for customers to confirm whether the data has been completely destroyed; 5) In a large-scale cloud environment, manually performing erase operations or relying on simple scripts to process storage devices one by one is not only inefficient, but also prone to omissions or errors, resulting in excessively long device retirement or resource recycling cycles, increasing data exposure windows and operating costs.

[0005] The above reasons together make it difficult for existing technologies to achieve the complete destruction of customer training data and verifiable and traceable security while utilizing the powerful computing power of the cloud, and thus cannot meet the strict requirements for full lifecycle management of data in high-security scenarios. Summary of the Invention

[0006] To address the above technical problems, this invention provides a technical solution for a method and system for securely erasing cloud-based training data.

[0007] The technical problem solved by this invention can be achieved by the following technical solutions: A method for securely erasing cloud-based training data, the method comprising: Step S1: Obtain the device identifier of the target NVMe solid-state drive, isolate the target NVMe solid-state drive from the cloud storage resource pool and mark it as unwritable; Step S2: Determine whether the training data stored in the target NVMe SSD meets the deletion conditions. If so, send a data destruction notification to the tenant corresponding to the target NVMe SSD, receive the electronic signature authentication data submitted by the tenant, and record the data destruction authorization information. Step S3: Send query commands to the target NVMe solid-state drives in batches to obtain the support status of hardware-level data erasure function, and dynamically generate erasure strategy based on the returned query results; Step S4: Perform multiple rounds of secure erasure operations on the target NVMe solid-state drive according to the erasure strategy; Step S5: Perform multi-point sampling verification and deep random verification on the erased target NVMe solid-state drive. After the verification is passed, generate a digital certificate and a compliance report, and update the device status of the target NVMe solid-state drive to the destroyed state.

[0008] Preferably, in step S2, while receiving the electronic signature authentication data submitted by the tenant, electronic signature authentication data submitted by the cloud administrator is also received, forming a dual digital signature verification.

[0009] Preferably, step S3 includes: Step S31: Send Sanitize commands to the target NVMe solid-state drives in batches to support detection instructions, and receive the returned log data; Step S32: Parse the log data, determine and record the hardware erase support capability of the target NVMe SSD based on the device model and firmware version in the log data. If the Sanitize hardware block erasure function is supported, a hardware-software alternating erasure strategy that includes hardware block erasure and software data overwriting will be generated. If the Sanitize hardware block erasure function is not supported, a software overwrite strategy that only includes software data overwriting will be generated.

[0010] Preferably, in step S4, When the erasure strategy is an alternating hardware and software erasure strategy, multiple rounds of alternating hardware and software erasure operations are performed, specifically including: The first round performs the Sanitize hardware block erasure operation. The second round performs a complete overwrite of all zero-value data. The third round involves performing a complete overwrite of all OneValue data. The fourth round involves overwriting all zero-value data. The fifth round of the Sanitize hardware block erasure operation is performed again. The sixth round involves overwriting all zero-value data. When the erasure strategy is a software overwrite strategy, multiple rounds of software overwrite operations are performed, specifically including: The first round performs a complete overwrite of all zero-value data. The second round involves performing a complete overwrite of all OneValue data. The third round involves overwriting all zero-value data. The fourth round involves overwriting all zero-value data. The data overwrite operation bypasses the system cache using direct I / O.

[0011] Preferably, in step S4, before performing multiple rounds of secure erasure operations, the following operations are also performed: Destroy the encryption keys corresponding to each training data on the target NVMe solid-state drive to achieve a dual linkage of encryption erasure and physical erasure.

[0012] Preferably, step S5 includes: Step S51: Read sector data from multiple preset points on the target NVMe solid-state drive, verify whether each sector data is zero, and if so, generate a first digital certificate. The first digital certificate includes the device serial number, erasure start timestamp, erasure end timestamp, record of the number of erasure rounds executed, hash value of the verification result of each preset point, and operator digital signature. Step S52: Read the data blocks corresponding to multiple random points of the target NVMe solid-state drive, read the data blocks of each random point and perform integrity verification, and write the hash value of the verification result into the blockchain or an immutable audit log. The multiple random points include the starting position, 1GB offset position, and 10GB offset position of the target NVMe solid-state drive; Step S53: Determine whether the verification results of steps S51 and S52 are both passed. If so, generate a second digital certificate and compliance report containing a complete destruction process record, and update the device status of the target NVMe solid-state drive in the cloud storage resource pool to the destroyed status.

[0013] Preferably, in step S4, when performing multiple rounds of secure erasure operations, the following thermal monitoring operation is also performed: The temperature value of the target NVMe solid-state drive is read in real time. When the temperature value exceeds the preset temperature threshold, the data writing speed of the target NVMe solid-state drive is automatically reduced or the erase task of the target NVMe solid-state drive is paused.

[0014] Preferably, the method supports the parallel execution of multiple secure erasure tasks, specifically: Based on the resource usage of the cloud data center, dynamically allocate the number of target NVMe solid-state drives to perform secure erase operations simultaneously; Record the erasure progress of each target NVMe SSD, and execute breakpoint continuation based on the erasure progress.

[0015] A cloud-based training data secure erasure system is provided for implementing the cloud-based training data secure erasure method described above. The system includes: The device management module is used to obtain the device identifier of the target NVMe solid-state drive, isolate the target NVMe solid-state drive from the cloud storage resource pool and mark it as unwritable; The permission confirmation module, connected to the device management module, is used to verify and record the authorization information and operation log for data destruction when the training data stored in the target NVMe solid-state drive meets the deletion conditions; wherein, the authorization information includes electronic signature authentication data submitted by the user and the cloud administrator respectively; The hardware detection module, connected to the permission confirmation module, is used to send query commands to the target NVMe solid-state drive in batches to obtain the support status of the hardware-level data erasure function, and dynamically generate an erasure strategy based on the returned query results. The erase execution module, connected to the hardware detection module, is used to perform multiple rounds of secure erase operations on the target NVMe solid-state drive according to the erase strategy; wherein the secure erase operation is an alternating hardware and software erase strategy that includes hardware block erasure and software data overwriting, or a software overwrite strategy that only includes software data overwriting.

[0016] Preferably, the system further includes: A thermal monitoring module, connected to the erase execution module, is used to read the temperature value of the target NVMe solid-state drive in real time. When the temperature value exceeds a preset temperature threshold, the module automatically reduces the data writing speed of the target NVMe solid-state drive or pauses the erase task of the target NVMe solid-state drive. The verification and audit trail module, connected to the erasure execution module, is used to perform multi-point sampling verification and deep random verification on the erased target NVMe solid-state drive. After the verification is passed, a digital certificate and a compliance report are generated. The resource management module, connected to the verification and audit trail module, is used to receive the verification pass signal output by the verification and audit trail module, update the device status of the target NVMe solid-state drive in the cloud storage resource pool to the destroyed state, and allocate the target NVMe solid-state drive to the redeployment queue or mark it as a device to be retired.

[0017] Beneficial effects: This invention isolates the target NVMe solid-state drive from the resource pool and marks it as unwritable, and combines tenant electronic signature authorization with a data destruction notification mechanism to achieve an auditable and traceable destruction authorization process; Meanwhile, by automatically detecting hardware-level erasure functions and dynamically generating erasure strategies through batch query commands, the problem of data residue caused by wear leveling in traditional overwriting methods is solved, and the hardware-level secure erasure capability is fully utilized to truly achieve irreversible destruction at the physical level. Building upon this foundation, a combination of multi-round secure erasure, multi-point sampling verification, and deep random verification significantly improves the reliability of data residue detection, ensuring that the training data of the previous tenant cannot be maliciously recovered in cross-tenant scenarios. Furthermore, digital certificates and compliance reports are generated, providing customers with verifiable destruction credentials and greatly enhancing the automation and efficiency of device retirement or resource recycling in large-scale cloud environments. This reduces the risk of omissions and operational costs associated with manual operations, thereby meeting the stringent requirements for full lifecycle management of training data in high-security scenarios while leveraging the powerful computing capabilities of the cloud. Attached Figure Description

[0018] Figure 1 This is a flowchart of the method of the present invention; Figure 2This is a schematic diagram of the hardware and software alternating erasure strategy of the present invention; Figure 3 This is a schematic diagram of the software overwriting strategy of the present invention; Figure 4 This is a system block diagram of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0021] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the scope of the invention.

[0022] Reference Figure 1 This invention provides a method for securely erasing cloud-based training data, applied to the storage management system of a cloud service provider, where customer training data is stored on an NVMe solid-state drive in the cloud. The method includes: Step S1: Obtain the device identifier of the target NVMe solid-state drive, isolate the target NVMe solid-state drive from the cloud storage resource pool and mark it as unwritable; Step S2: Determine whether the training data stored in the target NVMe SSD meets the deletion conditions. If so, send a data destruction notification to the tenant corresponding to the target NVMe SSD, receive the electronic signature authentication data submitted by the tenant, and record the data destruction authorization information. Step S3: Send query commands to the target NVMe solid-state drives in batches to obtain the support status of hardware-level data erasure function, and dynamically generate erasure strategy based on the returned query results; Step S4: Perform multiple rounds of secure erasure operations on the target NVMe solid-state drive according to the erasure strategy; Step S5: Perform multi-point sampling verification and deep random verification on the erased target NVMe solid-state drive. After the verification is passed, generate a digital certificate and a compliance report, and update the device status of the target NVMe solid-state drive to the destroyed state.

[0023] Specifically, in this embodiment of the invention, the problems in the prior art, such as the inability of overwrite commands to completely erase data due to wear leveling of NVMe solid-state drives, the vulnerability of training data residues in multi-tenant shared scenarios to malicious recovery, the lack of automatic invocation of hardware-level sanitize erasure capabilities, the inability of cloud service providers to provide auditable and verifiable destruction credentials, and the low efficiency and error-prone nature of manual erasure in large-scale cloud environments, are addressed by isolating the target NVMe solid-state drive from the resource pool and marking it as unwritable, constructing a traceable destruction authorization process combined with tenant electronic signature authorization, automatically detecting hardware-level erasure capabilities and dynamically generating erasure strategies through batch query commands, executing multiple rounds of secure erasure operations supplemented by multi-point sampling and deep random verification. This avoids the data residue risks caused by physical block mapping hidden areas in traditional software overwriting, the potential for cross-tenant data leakage, and security gaps caused by human operation omissions or errors. It achieves true irreversible data destruction at the hardware level, automatically generates legally valid digital certificates and compliance reports, and enables efficient and automated recycling and status tracking of devices in large-scale cloud environments. Thus, while utilizing the powerful computing power of the cloud, it meets the strict requirements for the full lifecycle management of training data in high-security scenarios.

[0024] Specifically, when performing secure erasure of training data in the cloud, the device identifier of the target NVMe SSD to be destroyed is obtained first, based on the storage device retirement process of a cloud service provider or the "complete data destruction" request initiated by the tenant through the cloud management console. The target NVMe SSD is then isolated from the resource pool and new training data writing requests are stopped to prevent new data from being written. Then, verify whether the training data on the target NVMe SSD has exceeded the retention period or completed the necessary backup. If so, send a destruction notice to the relevant tenant and obtain the electronic signature authorization sent by the tenant, and record the authorization information and timestamp of data destruction. Next, query commands are sent to the target hard drives in batches, the returned log data is parsed and a wipe policy is dynamically generated, and the corresponding secure wipe operation is executed according to the wipe policy; After erasure is completed, multiple preset points and multiple random points are read for verification. When the verification is successful, a digital certificate and compliance report containing a complete record of the destruction process are generated. Then, the device status of the target NVMe solid-state drive in the cloud storage resource pool is updated to the destroyed status. Finally, the target NVMe SSD is marked as a redeployable or decommissioned device, thus providing tenants and regulators with verifiable, traceable, and legally valid proof of data destruction.

[0025] In a preferred embodiment of the present invention, in step S2, while receiving the electronic signature authentication data submitted by the tenant, electronic signature authentication data submitted by the cloud administrator is also received, forming a dual digital signature verification.

[0026] Specifically, since data destruction operations in a cloud storage environment are irreversible, once executed, training data will be permanently lost. If only tenant authorization or cloud administrator operation is performed, there may be security risks such as tenant account theft leading to malicious destruction or unauthorized deletion by internal administrators. Therefore, in this embodiment of the invention, in addition to completing tenant electronic signature authentication, the electronic signature authentication data of the cloud administrator is further obtained, forming a dual digital signature verification mechanism.

[0027] In practice, after receiving the tenant's digital signature confirmation, the system automatically triggers the cloud administrator's secondary signature process, requiring the cloud administrator with device management privileges to use their private key to digitally sign the destruction operation, and encapsulates the two signatures together with the timestamp, device identifier, and operation content into an immutable authorization credential.

[0028] This mechanism ensures that any data destruction operation requires dual authorization from both the data owner (i.e., the tenant) and the platform operator (i.e., the cloud administrator) before it can be executed. This effectively prevents unilateral misoperation or malicious attacks and ensures the legality, traceability, and non-repudiation of the destruction process.

[0029] In a preferred embodiment of the present invention, step S3 includes: Step S31: Send Sanitize commands to the target NVMe solid-state drives in batches to support detection instructions, and receive the returned log data; Step S32: Parse the log data, determine and record the hardware erase support capability of the target NVMe SSD based on the device model and firmware version in the log data. If the Sanitize hardware block erasure function is supported, a hardware-software alternating erasure strategy that includes hardware block erasure and software data overwriting will be generated. If the Sanitize hardware block erasure function is not supported, a software overwrite strategy that only includes software data overwriting will be generated.

[0030] Specifically, since NVMe SSDs deployed in cloud data centers may come from different manufacturers and batches, their firmware versions and hardware capabilities vary. Some devices support hardware-level Sanitize block erasure commands, while some older or low-cost devices may not. Applying a uniform erasure strategy to all devices would prevent devices supporting hardware erasure from fully utilizing their efficient and thorough hardware erasure capabilities, while devices not supporting hardware erasure would return errors and interrupt the task if the Sanitize command were forcibly invoked. Therefore, in this embodiment of the invention, a hardware capability adaptive detection step is added before performing multiple rounds of secure erasure operations.

[0031] Specifically, firstly, by batch calling the Sanitize command support detection instruction, namely the nvme sanitize-log instruction, a Sanitize command support detection request is sent to the target NVMe solid-state drive to be erased, and the returned log data is received. This log data includes the device identifier, model name, firmware version, and the flag bits of the supported command set, etc.

[0032] Next, the returned log data is parsed to extract the device model and firmware version information, and the bit values ​​corresponding to the Sanitize function in the command support flags are read. If the flag is a valid value (e.g., 1), the device is determined to support the Sanitize hardware block erasure function. The system records it as "supports hardware erasure" and dynamically generates a hardware and software alternating erasure strategy. This strategy explicitly specifies the execution order of hardware erasure and software overwriting. If the flag is invalid (e.g., 0), the device is determined to not support hardware block erasure. The system records it as "software overwrite only" and dynamically generates a downgrade erasure strategy that only includes multiple rounds of software overwrite.

[0033] Through the aforementioned hardware capability batch detection and dynamic strategy generation mechanism, this invention can automatically identify the actual erasure capability of NVMe solid-state drives (SSDs). For devices supporting hardware erasure, it enables an efficient alternating hardware and software erasure process; for devices not supporting hardware erasure, it automatically downgrades to a pure software overwrite process, while simultaneously recording downgrade prompts in the audit log. This mechanism eliminates the risk of erasure failure due to differences in device capabilities and ensures high reliability and automated execution of erasure tasks in large-scale mixed device scenarios.

[0034] In a preferred embodiment of the present invention, in step S4, When the erasure strategy is an alternating hardware and software erasure strategy, multiple rounds of alternating hardware and software erasure operations are performed, specifically including: The first round performs the Sanitize hardware block erasure operation. The second round performs a complete overwrite of all zero-value data. The third round involves performing a complete overwrite of all OneValue data. The fourth round involves overwriting all zero-value data. The fifth round of the Sanitize hardware block erasure operation is performed again. The sixth round involves overwriting all zero-value data. When the erasure strategy is a software overwrite strategy, multiple rounds of software overwrite operations are performed, specifically including: The first round performs a complete overwrite of all zero-value data. The second round involves performing a complete overwrite of all OneValue data. The third round involves overwriting all zero-value data. The fourth round involves overwriting all zero-value data. The data overwrite operation bypasses the system cache using direct I / O.

[0035] Specifically, in this embodiment of the invention, a differentiated multi-round secure erase sequence is designed for NVMe solid-state drives with different hardware capabilities to overcome the risk of data residue in situations such as wear leveling, hidden physical blocks, and residual charge in flash memory when using a single erase mode.

[0036] Specifically, refer to Figure 2 For NVMe SSDs that support the Sanitize hardware block erasure function, an alternating hardware and software erasure strategy is implemented, specifically as follows: First round: Execute the NVMe Sanitize hardware block erasure operation. By sending the Sanitize command to the SSD controller, hardware-level block erasure is triggered, forcing all physical blocks of the entire NAND flash memory to the initial state. This operation is not affected by logical block mapping and wear leveling, and can clear hidden areas and reserved space that are not visible to the user.

[0037] Second round: Perform a full disk zero value (0x00) data overwrite, writing each logical address of the entire disk to 0x00 to ensure that the data reaches the physical medium directly.

[0038] Third round: Perform full disk one-value (0xFF) data overwrite, write all disk logical addresses to 0xFF, and form an alternating flip with 0x00 in the previous round to eliminate residual charge in the flash memory cells and improve the thoroughness of the overwrite.

[0039] Fourth round: Perform a full zero-value (0x00) data overwrite again, using zero values ​​to cover the one values ​​from the previous round, further disrupting the charge distribution and making data recovery more difficult.

[0040] Fifth round: The NVMe Sanitize hardware block erasure operation is executed for the second time. After multiple software overwrites, hardware-level erasure is triggered again to remove hidden mapping areas and metadata residues that may have been missed due to software overwrites.

[0041] Sixth round: Finally, all data is overwritten to zero (0x00), with zero as the final state, to facilitate subsequent verification operations to confirm whether the data has been completely reset to zero.

[0042] Specifically, in this embodiment of the invention, the above six rounds are merely a typical example, and the actual erasure strategy is not limited to six rounds. The overall design concept is as follows: First, hardware erases and clears hidden areas → multiple software overwrites alternately flip data states → hardware erases again → finally, software resets to zero.

[0043] The number of alternating rounds can be increased or decreased according to the security level requirements. For example, an intermediate round of full disk random number overwriting can be added, or "hardware erase + software overwrite" can be cycled multiple times until the expected security strength is achieved.

[0044] Accordingly, refer to Figure 3 For NVMe SSDs that do not support the Sanitize hardware block erasure function, all hardware erasure rounds are automatically skipped, and only a software overwrite strategy is executed, specifically: First round: Perform NVMe Sanitize hardware block erasure operation; Second round: Perform a full overwrite of all 0xFF data; Third round: Perform a full overwrite of all zero-value (0x00) data again; Fourth round: Finally, perform a complete overwrite of all zero-value (0x00) data.

[0045] As can be seen, for NVMe SSDs that do not support the Sanitize hardware block erasure function, the system automatically skips the hardware erasure round, performs only the software overwrite operation, and generates a prompt message containing the device identifier, firmware version and "Sanitize is not supported, downgraded to pure software overwrite" in the audit log for subsequent audit traceability.

[0046] Similarly, the software's overwrite strategy is not limited to the four rounds mentioned above. Rounds can be added according to actual security needs, such as adding intermediate rounds of random data overwriting across the entire disk or repeating multiple zero / one alternating overwrites.

[0047] More specifically, in this embodiment of the invention, whether it is a hardware and software alternating erasure strategy or a software overwrite strategy, the data continuation operation uses direct I / O to bypass the system cache, so as to ensure that the data is directly written to the physical storage medium. This Direct I / O method explicitly specifies the oflag=direct parameter when calling the Linux device driver command (dd command), which allows data to be written directly from the user space buffer to the direct memory access (DMA) area of ​​the storage device without going through the operating system's page cache. This avoids incomplete overwriting caused by cache delays or data residue in the cache, ensuring that the data of each overwrite instruction is written directly to the physical media of the NVMe solid-state drive.

[0048] In other words, the above data overwrite operation does not rely on the operating system's file system caching mechanism, but instead sends a write command through the Direct I / O interface, forcing the solid-state drive controller to write the data into the physical block mapped by the corresponding logical block address.

[0049] Combining the ability of Sanitize hardware erasure to clean up hidden areas, the multi-round alternating erasure method of this invention can effectively combat the data residue risks caused by wear leveling, copy-on-write, and reserved space (OP) of NVMe solid-state drives.

[0050] In a preferred embodiment of the present invention, in step S4, before performing multiple rounds of secure erasure operations, the following operations are also performed: Destroy the encryption keys corresponding to each training data on the target NVMe solid-state drive to achieve a dual linkage of encryption erasure and physical erasure.

[0051] Specifically, considering that customer training data in cloud environments is typically stored on NVMe solid-state drives using full-disk encryption or file-level encryption, even if some data blocks are not overwritten during subsequent physical erasure due to mechanisms such as wear leveling and bad block remapping, the remaining ciphertext data still cannot be deciphered into plaintext without the corresponding decryption key. If the encryption key is not destroyed, an attacker with the highest system privileges or a cloud service provider administrator may still recover the ciphertext data from the remaining sectors after physical erasure and decrypt it using the retained key. Based on this, in this embodiment of the invention, before performing multiple rounds of physical-level security erasure operations, a linked destruction step of the encryption key is first executed.

[0052] In practice, the system calls the Key Management Service (KMS) interface of the cloud platform and sends a key destruction request to KMS based on the key identifier associated with the training data stored on the target NVMe SSD. This request carries dual authorization credentials, including the tenant's digital signature and the cloud administrator's digital signature. After KMS verifies the authorization, it permanently deletes the corresponding encryption key from the secure storage area and records the deletion operation in an immutable audit log.

[0053] If the training data uses the tenant-managed key (Bring Your Own Key, BYOK) mode, the system will notify the tenant's key management system to destroy the key after verifying authorization, and the tenant will return the destruction confirmation credential.

[0054] In a preferred embodiment of the present invention, step S5 includes: Step S51: Read sector data from multiple preset points on the target NVMe solid-state drive, verify whether each sector data is zero, and if so, generate a first digital certificate. The first digital certificate includes the device serial number, erasure start timestamp, erasure end timestamp, record of the number of erasure rounds executed, hash value of the verification result of each preset point, and operator digital signature. Step S52: Read the data blocks corresponding to multiple random points of the target NVMe solid-state drive, read the data blocks of each random point and perform integrity verification, and write the hash value of the verification result into the blockchain or an immutable audit log. The multiple random points include the starting position, 1GB offset position, and 10GB offset position of the target NVMe solid-state drive; Step S53: Determine whether the verification results of steps S51 and S52 are both passed. If so, generate a second digital certificate and compliance report containing a complete destruction process record, and update the device status of the target NVMe solid-state drive in the cloud storage resource pool to the destroyed status.

[0055] Specifically, in order to ensure the authenticity and effectiveness of multiple rounds of secure erasure operations and to provide tenants and regulatory agencies with legally valid and tamper-proof destruction certificates, this embodiment of the invention further designs a multi-stage hierarchical verification and certificate generation process, corresponding to multi-point sampling verification and deep random verification, and introduces a blockchain evidence storage mechanism to enhance the credibility of audit results.

[0056] Specifically, firstly, after completing multiple rounds of secure erasure, multi-point sampling verification is triggered. Specifically, the system uses the dd command combined with the oflag=direct parameter to directly read sector data from multiple preset points on the target NVMe solid-state drive (including but not limited to the device's starting sector, the middle sector corresponding to half of the total capacity, and the last sector, etc.), converts each sector data read into a hexadecimal string, and checks whether all bytes are zero. If the sector data of all preset points are detected as zero, the multi-point sampling verification is passed, and the system then generates the first digital certificate. The first digital certificate encapsulates the device serial number, the erasure start timestamp, the erasure end timestamp, the list of actual erasure rounds, the hash value of the verification result of each preset point, and the digital signature of the cloud administrator who operated this destruction task, as a trusted credential for preliminary verification.

[0057] Next, to prevent the sampling verification points from being maliciously predicted or pre-cleaned while residual data remains in other areas, a deep random verification is further performed. Specifically, the system generates multiple random offset addresses based on the device serial number and the current timestamp, including at least the starting position of the device's storage space (0-byte offset), a 1GB offset, and a 10GB offset. The system reads the data blocks corresponding to these random points, verifies their integrity (i.e., verifies whether each byte is zero), then hashes the verification results of all random points, and writes the final hash value, verification timestamp, and random point offset address into the blockchain. The blockchain's smart contract records this verification transaction, returns the block height and transaction identifier, ensuring that the destruction record is immutable, traceable, and non-repudiable.

[0058] Then, a comprehensive judgment operation is performed. Specifically, the system only considers the data destruction operation to be completely successful when both the multi-point sampling verification and deep random verification return a "pass" result. At this time, the system summarizes the first digital certificate generated by the multi-point sampling verification, the evidence information written to the blockchain by the deep random verification, and the complete authorization records, erasure logs, and other data to generate a second digital certificate and a compliance report containing all the records of the above destruction process.

[0059] Simultaneously, the device status of the verified target NVMe solid-state drives in the cloud storage resource pool is updated from "pending destruction" to "destroyed"; among them, for devices that need to be decommissioned, the system further marks them as "decommissionable devices"; for devices that can be redeployed, the system allocates them to the queue to be formatted or to be reused, waiting for subsequent lifecycle management.

[0060] Finally, the system packages the second digital certificate and compliance report together to form a complete destruction proof package, which is then provided to relevant tenants and regulatory agencies.

[0061] In a preferred embodiment of the present invention, during step S4, when performing multiple rounds of secure erasure operations, the following thermal monitoring operation is also performed: The temperature value of the target NVMe solid-state drive is read in real time. When the temperature value exceeds the preset temperature threshold, the data writing speed of the target NVMe solid-state drive is automatically reduced or the erase task of the target NVMe solid-state drive is paused.

[0062] Specifically, in large-scale parallel erase scenarios, multiple NVMe SSDs operate under continuous high-load write conditions for extended periods, leading to significant heat accumulation in the SSD's internal controller chip and NAND flash memory chips. As temperatures rise, SSD performance may decrease due to controller overheating and frequency throttling, potentially causing flash memory charge drift, data write errors, or even physical damage. Therefore, this embodiment of the invention introduces an active thermal monitoring and dynamic speed adjustment mechanism while performing multiple rounds of secure erase operations.

[0063] Specifically, the system reads the temperature value of the target NVMe solid-state drive at fixed time intervals (e.g., once every 10 seconds) through the Intelligent Platform Management Interface (IPMI) or NVMe Management Interface (NVMe-MI) protocol. When the real-time temperature value is greater than or equal to the preset warning threshold but less than the pause threshold, the system automatically sends a speed-down command to the erase execution module to reduce the data writing speed of the device and slow down the heat generation rate. When the temperature continues to rise and reaches or exceeds the pause threshold, the system immediately sends a pause command, suspends all erase operation threads currently being executed by the device, and uses a breakpoint resume recording mechanism to save the currently completed erase round number and sector offset to non-volatile storage media. Once the temperature drops below the recovery threshold, the system automatically resumes the erase task and continues execution from the breakpoint.

[0064] As a preferred embodiment of the present invention, the method supports the parallel execution of multiple secure erasure tasks, specifically: Based on the resource usage of the cloud data center, dynamically allocate the number of target NVMe solid-state drives to perform secure erase operations simultaneously; Record the erasure progress of each target NVMe SSD, and execute breakpoint continuation based on the erasure progress.

[0065] Specifically, considering that the retirement of large-scale equipment or tenant termination in cloud data centers may involve erasing dozens or even hundreds of NVMe solid-state drives simultaneously, a serial approach to erasing them one by one would be extremely inefficient and unable to meet the need for rapid resource reclamation. Therefore, this embodiment of the invention introduces a dynamic parallel scheduling mechanism and a breakpoint resume recording mechanism.

[0066] Specifically, when executing the erase task, the system obtains the global resource usage status of the cloud data center in real time through the monitoring interface, including the CPU utilization rate, available memory capacity, storage I / O queue depth, and PCIe bandwidth utilization rate of each computing node. Based on the preset resource level threshold (for example, when the CPU utilization rate is below 60% and the storage I / O queue depth is less than 8, additional concurrency is allowed), the system dynamically calculates the number of erase tasks that can be executed simultaneously and allocates execution tokens to each batch of target NVMe solid disks to be erased accordingly.

[0067] Meanwhile, during the execution of each erase task, the system writes the current device's erase progress (including the sequence number of the erased erase round, the offset of the sector erased in the current round, and the timestamp of the last successful write) into a separate progress file at fixed sector intervals or after each erase round is completed. This progress file is stored in a non-volatile storage medium. When the erase task is interrupted due to abnormal circumstances such as system restart, network interruption, device overheating, or manual termination, the system will first read the progress file of the device when the task restarts, and continue to perform the erase operation from the recorded round and sector offset, without having to start from the beginning.

[0068] Through the aforementioned dynamic parallel scheduling and breakpoint continuation mechanism, this invention maximizes the parallel efficiency of the erasure task under resource constraints, while ensuring the reliability and recoverability of long-term, large-scale erasure tasks, significantly improving the automation level and overall throughput of cloud data center equipment recycling.

[0069] The following two specific examples illustrate the above-mentioned method for securely erasing cloud-based training data: Example 1: Cloud service provider equipment retirement scenario This embodiment 1 is applied to the storage device retirement process of a cloud service provider. This cloud service provider adopts a storage-compute separation architecture, where customer training data is stored on NVMe solid-state drives in the cloud, and training computing power is provided by a domestic GPU cluster in a private cloud. Specifically: Step 1: Device Identification and Isolation The cloud storage management system detected that a batch of NVMe solid-state drives had reached the end of their service life and needed to be retired and replaced. The system marked this batch of devices with a list of identifiers, including 24 drives from / dev / nvme0n1 to / dev / nvme0n24. Detailed device information, including device serial number, capacity, firmware version, etc., can be obtained by executing the commands `nvme list` and `lsblk -d | grep nvme`.

[0070] The system removes these devices from the cloud storage resource pool, sets their status to "pending destruction," and stops all new I / O requests.

[0071] For devices still in use, the system records the distribution of training data stored on them and tenant occupancy information.

[0072] Step 2: Permission Confirmation and Authorization Records The system confirms that the training data on these devices has been migrated or backed up, and the data retention period has expired. A data destruction notification is sent to the relevant tenants via the cloud management console, requiring tenant representatives to log in to the system and confirm with a digital signature.

[0073] In this embodiment 1, the 24 hard drives involve 8 tenants. The system sends notifications to each tenant and obtains digital signature confirmations from all tenants, recording data destruction authorization information. This data destruction authorization information includes tenant ID, confirmation timestamp, authorization token, IP address, etc., to ensure the legality and traceability of the destruction operation.

[0074] Step 3: Hardware Capability Testing The `nvme sanitize-log` command was executed in batches to check the sanitize command support of 24 hard drives. The test results showed that 22 drives supported the sanitize function, while 2 drives did not. The system categorized and recorded hardware capability information by device model and firmware version. For devices that supported the sanitize hardware block erasure function, an alternating hardware and software erasure strategy was generated, which included both hardware block erasure and software data overwriting. For devices that did not support the sanitize hardware block erasure function, a software overwrite strategy was generated, which only included software data overwriting.

[0075] Step 4: Multiple rounds of safe erasure Based on the erasure strategy generated in step 3, multiple rounds of alternating erasure are performed on each hard drive, specifically: For 22 hard drives that support the Sanitize hardware block erasure function: Perform hardware erase → write 0 → write 1 → write 0 → hardware erase → write 0; For two hard drives that do not support the Sanitize hardware block erasure function: automatically skip the hardware erasure rounds and execute write 0 → write 1 → write 0 → write 0 (four rounds of software overwrite). The software overwrite operation is implemented using the following command: Bash # Zero value overwrite dd if= / dev / zero of= / dev / nvme0n1 bs=1M status=progress oflag=direct # One Value Overwrite tr '\000' '\377' < / dev / zero | dd of= / dev / nvme0n1 bs=1M status=progress oflag=direct The alternating hardware and software erasure operation is implemented using the following command: Bash nvme sanitize / dev / nvme0n1 --sanact=2 Step 5: Parallel Scheduling and Thermal Monitoring Based on the current load of the data center, the number of parallel erase tasks is set to 8, and the 24 hard drives are divided into 3 batches for execution. The system reads the device temperature information in real time through the IPMI interface. When the temperature of 3 hard drives exceeds 65°C, the write speed is automatically reduced and some tasks are paused, resuming only when the temperature drops below 50°C. The system records the erase progress of each hard drive and supports breakpoint resume functionality to prevent task failure due to abnormal interruptions.

[0076] Step 6: Multi-site sampling verification After each hard drive is erased, a verification operation is performed: Check the partition table: Execute `lsblk / dev / nvme0n1` to confirm no partition information. Read the first 10 sectors: `dd if= / dev / nvme0n1 bs=512 count=10 | hexdump -C`, confirm all are 00. The system generates a digital certificate for each hard drive containing the following information: Device serial number and identifier; Erase the start and end timestamps; Record of the erase cycles performed; The hash value of the verification result of the starting position; Operator digital signature.

[0077] Step 7: Deep Random Validation Randomly read data blocks at positions 0, 1GB, 10GB, and 100GB, and execute the following command for deep verification: Bash for offset in 0 1073741824 10737418240 107374182400; do echo "Checking offset $offset..." dd if= / dev / nvme0n1 bs=512 count=1 skip=$((offset / 512)) 2> / dev / null |hexdump -C | head -n 2 done After confirming that all data read from all points is zero, the hash value of the verification result is written to the blockchain to ensure that the destruction record cannot be tampered with.

[0078] Step 8: Audit Report Generation and Equipment Disposal For the 24 verified hard drives, the system automatically generates a GDPR-compliant "right to be forgotten" enforcement certificate, including a complete record of the destruction process, verification results, and digital certificates. The report is provided to the relevant tenants and regulatory agencies for archiving.

[0079] The system updates the asset management system records, marks the equipment status as "destroyed - ready for retirement", and completes the equipment retirement disposal process.

[0080] Example 2: Tenant move-out scenario Example 2 applies to a financial institution tenant who, due to business adjustments, decided to terminate its use of cloud services and delete all training data. The tenant initiated a "complete data destruction" request through the cloud management console. Specifically: Steps: Request reception and device location The system receives a tenant's destruction request, verifies the tenant's identity and permissions, and confirms that the request contains two-factor authentication information. It then identifies the distribution of the tenant's training data, finding that the data is stored on five NVMe SSDs, three of which are exclusively used by the tenant, and two are shared with other tenants (multi-tenant partitioned storage).

[0081] Steps: Permission confirmation and authorization record For the three dedicated hard drives, the system directly obtains the tenant's digital signature confirmation. For the two shared hard drives, the system identifies the specific partition where the tenant's data is located, records the LBA range of these partitions, and sends notifications to other tenants on the shared device to coordinate the data migration time window. After obtaining the consent of all relevant tenants, the system migrates the data of the other tenants to the new device and obtains confirmation information of migration completion.

[0082] Steps: Destroy the encryption key in conjunction with the encryption process. Before physical erasure, the system first destroys the encryption key of the tenant's training data, thus achieving cryptographic erasure. After the key is destroyed, even if there is residual data at the physical layer, it cannot be decrypted, achieving dual protection through both cryptographic and physical erasure.

[0083] Steps 4-8: Erase Execution and Verification The system performs multiple rounds of alternating erasure, verification, and audit report generation following the steps in Example 1. After erasure is complete, the system generates a data destruction certificate that complies with financial regulatory requirements and provides it to the tenant, containing blockchain evidence and a digital signature.

[0084] Reference Figure 4 The present invention also provides a cloud-based training data secure erasure system for implementing the cloud-based training data secure erasure method described above. The system is applied in a storage-compute separation architecture and includes: The device management module 100 is used to obtain the device identifier of the target NVMe solid-state drive, isolate the target NVMe solid-state drive from the cloud storage resource pool and mark it as unwritable; The permission confirmation module 200, connected to the device management module 100, is used to verify and record the authorization information and operation log of data destruction when the training data stored in the target NVMe solid-state drive meets the deletion conditions; wherein, the authorization information includes electronic signature authentication data submitted by the user and the cloud administrator respectively; The hardware detection module 300 is connected to the permission confirmation module 200 and is used to send query commands to the target NVMe solid-state drive in batches to obtain the support status of the hardware-level data erasure function, and dynamically generate an erasure strategy based on the returned query results. The erase execution module 400 is connected to the hardware detection module 300 and is used to perform multiple rounds of secure erase operations on the target NVMe solid-state drive according to the erase strategy; wherein the secure erase operation is an alternating hardware and software erase strategy that includes hardware block erasure and software data overwriting or a software overwrite strategy that only includes software data overwriting. The thermal monitoring module 500 is connected to the erase execution module 400 and is used to read the temperature value of the target NVMe solid-state drive in real time. When the temperature value exceeds the preset temperature threshold, the data writing speed of the target NVMe solid-state drive is automatically reduced or the erase task of the target NVMe solid-state drive is paused. The verification and audit trail module 600 is connected to the erasure execution module 400 and is used to perform multi-point sampling verification and deep random verification on the erased target NVMe solid-state drive. After the verification is passed, a digital certificate and a compliance report are generated. The resource management module 700, connected to the verification and audit trail module 600, is used to receive the verification pass signal output by the verification and audit trail module, update the device status of the target NVMe solid-state drive in the cloud storage resource pool to the destroyed state, and allocate the target NVMe solid-state drive to the redeployment queue or mark it as a device to be retired.

[0085] Specifically, in this embodiment of the invention, after receiving a device retirement instruction or a tenant destruction request, the device management module 100 isolates the target NVMe solid-state drive from the resource pool and marks it as unwritable; the permission confirmation module 200 obtains electronic signature authentication from the tenant and the cloud administrator respectively, forming a dual authorization record; the hardware detection module 300 detects the hardware erasure capability of each device by sending Sanitize commands in batches and dynamically generates differentiated software and hardware alternating erasure strategies or pure software overwrite degradation strategies; the erasure execution module 400 executes multiple rounds of secure erasure operations according to the generated strategies, during which the thermal monitoring module 500 reads data in real time. Device temperature is monitored, and tasks are automatically slowed down or paused based on a preset threshold to protect the hardware. After erasure, the verification and audit trail module 600 first performs multi-point sampling verification and generates a first digital certificate. Then, it performs deep verification on random points such as the starting position, 1GB offset, and 10GB offset, and writes the hash value of the verification result to the blockchain. Only when both verifications pass, a second digital certificate containing a complete destruction record and a compliance report are generated. The resource management module 700 receives the verification pass signal, updates the device status to destroyed, and allocates it to the redeployment queue or marks it as to be decommissioned, thereby achieving fully automated, auditable, and non-repudiable secure erasure of cloud training data.

[0086] The cloud-based training data secure erasure system described above will be explained in detail below with a specific embodiment: Example

[0087] Device Management Module 100: Interacts with the cloud storage controller via API to obtain status information of all NVMe SSDs, supporting batch device isolation and resource pool management. This module can identify device age, health status, tenant distribution, and other information, and provides device lifecycle management functions.

[0088] The authorization verification module 200 integrates cloud identity authentication services to verify the digital signatures of tenants and operators, supporting two-factor authentication and multi-level approval processes. It records complete authorization chain information, including authorization time, authorizer, and authorized content, generating tamper-proof operation authorization records.

[0089] Hardware detection module 00: Batch calls the nvme-cli toolset to concurrently detect the Sanitize command support status of a large number of devices. It parses device logs to obtain information such as device model, firmware version, and health status, stores this information in a hardware capability database categorized by device type, and dynamically generates optimized erasure strategies.

[0090] The parallel erase execution module 400 includes a hardware erase submodule and a software overwrite submodule, supporting task priority scheduling, dynamic adjustment of concurrency, and breakpoint resume functionality. This module uses direct I / O to perform data overwrite, ensuring that data is written directly to the physical medium, bypassing the system cache. It supports multi-batch task management and can handle erase tasks for hundreds of hard drives simultaneously.

[0091] Thermal Monitoring Module 500: Reads device temperature information in real time via IPMI, NVMe-MI interface, or SMART data. It has a built-in temperature threshold database for each device model, automatically triggering a speed reduction or pause mechanism when the temperature exceeds the threshold to protect the device from damage. It records temperature change curves, providing data support for device health management.

[0092] The verification and audit trail module 600 includes a verification submodule and an audit trail submodule, wherein: Verification Submodule: Executes multi-dimensional verification strategies, including partition checking, sector reading, and multi-point random sampling. It supports custom verification points and depth, generating digital certificates containing verification timestamps, verification points, and hash values. It provides visual verification reports and supports exporting to PDF, CSV, and other formats.

[0093] The audit trail submodule records the complete destruction process (including authorization information, operation logs, verification results, and certificates) and writes it to a blockchain or secure audit database. It supports exporting compliance reports that meet the requirements of various regulations such as GDPR, HIPAA, PCI-DSS, and the Information Security Standard 2.0. It provides audit log query and traceability functions to ensure that all operations are traceable and non-repudiable.

[0094] Resource Management Module 700: Maintains the status of the storage resource pool and manages the lifecycle of devices. It updates device status (redeployment or marking for retirement) after destruction, supports integration with the asset management system, and automatically updates device ledger information.

[0095] In summary, this invention proposes a secure method and system for erasing cloud-based training data. This method and system isolates the target NVMe SSD from the resource pool and marks it as unwritable. It then constructs a traceable destruction authorization process by combining dual digital signature authorization from the tenant and cloud administrator. The system batch-tests the device's hardware erasure capabilities and dynamically generates differentiated erasure strategies, such as alternating hardware and software erasure or pure software overwriting. Before physical erasure, it destroys the encryption key to achieve dual protection against both encrypted and physical erasure. During erasure, it dynamically adjusts the write speed based on real-time temperature or pauses the task and supports resuming interrupted operations. After erasure, it sequentially performs multi-point sampling verification (generating a first digital certificate) and deep random verification (writing the verification result hash value to the blockchain). Only when both verifications pass is a second digital certificate containing a complete destruction record and a compliance report generated, and the device status updated. This achieves thorough, verifiable, and irreversible destruction of cloud-based training data.

[0096] Compared with the prior art, the present invention has the following significant advantages: Completely eliminate hidden area data residue: By alternating between hardware Sanitize block erasure and direct I / O software overwrite in multiple rounds, it can clear data in user-invisible hidden areas of NVMe solid-state drives caused by wear leveling, reserved space, bad block remapping and other mechanisms, overcoming the limitation of traditional overwrite methods that can only operate on logical addresses.

[0097] Adaptive heterogeneous device erasure capability: Batch detection of the Sanitize command support status of each NVMe SSD, dynamically generating differentiated erasure strategies—devices that support hardware erasure enable alternating hardware and software erasure, while devices that do not support automatic degradation to multi-round software overwrite and record audit logs, ensuring high reliability and automated execution of erasure tasks in large-scale mixed device scenarios.

[0098] Dual security mechanism: The encryption key corresponding to the training data is destroyed before physical erasure, realizing dual protection of "encryption erasure + physical erasure". Even if there is residual ciphertext on the physical medium, the plaintext cannot be recovered without the decryption key, which significantly improves the security of data destruction.

[0099] Verifiable blockchain evidence storage and tiered certificates: A first digital certificate (containing device serial number, timestamp, erasure round, verification hash value and operator signature) is generated through multi-point sampling verification. Then, deep verification is performed at random points such as the starting position, 1GB offset, and 10GB offset. The hash value of the verification result is written into the blockchain. Only when both verifications pass is the final second digital certificate and compliance report generated, ensuring that the destruction record is tamper-proof, traceable, and non-repudiable, meeting the compliance requirements of regulations such as the GDPR "right to be forgotten".

[0100] Intelligent parallel scheduling and thermal monitoring: Based on the real-time resource usage of the cloud data center, the number of parallel erase tasks is dynamically allocated, the temperature of NVMe solid-state drives is actively monitored and the task is automatically slowed down or paused according to the preset threshold. Combined with the breakpoint resume mechanism, the erase efficiency is maximized while protecting the hardware, and the efficient and automated recycling of large-scale devices is achieved.

[0101] End-to-end automation and auditability: From device isolation, dual authorization, hardware detection, multi-round erasure, thermal monitoring, hierarchical verification, blockchain evidence storage to final status update and report generation, a complete automated closed loop is formed. All operation records are tamper-proof, significantly reducing the risk of errors caused by manual intervention and the cost of security management.

[0102] The above description is merely a preferred embodiment of the present invention and does not limit the implementation and protection scope of the present invention. Those skilled in the art should realize that any equivalent substitutions and obvious changes made based on the description and illustrations of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for securely erasing cloud-based training data, characterized in that, The method includes: Step S1: Obtain the device identifier of the target NVMe solid-state drive, isolate the target NVMe solid-state drive from the cloud storage resource pool and mark it as unwritable; Step S2: Determine whether the training data stored in the target NVMe SSD meets the deletion conditions. If so, send a data destruction notification to the tenant corresponding to the target NVMe SSD, receive the electronic signature authentication data submitted by the tenant, and record the data destruction authorization information. Step S3: Send query commands to the target NVMe solid-state drives in batches to obtain the support status of hardware-level data erasure function, and dynamically generate erasure strategy based on the returned query results; Step S4: Perform multiple rounds of secure erasure operations on the target NVMe solid-state drive according to the erasure strategy; Step S5: Perform multi-point sampling verification and deep random verification on the erased target NVMe solid-state drive. After the verification is passed, generate a digital certificate and a compliance report, and update the device status of the target NVMe solid-state drive to the destroyed state.

2. The cloud-based training data secure erasure method according to claim 1, characterized in that, In step S2, while receiving the electronic signature authentication data submitted by the tenant, the system also receives the electronic signature authentication data submitted by the cloud administrator, forming a dual digital signature verification.

3. The cloud-based training data secure erasure method according to claim 1, characterized in that, Step S3 includes: Step S31: Send Sanitize commands to the target NVMe solid-state drives in batches to support detection instructions, and receive the returned log data; Step S32: Parse the log data, determine and record the hardware erase support capability of the target NVMe SSD based on the device model and firmware version in the log data. If the Sanitize hardware block erasure function is supported, a hardware-software alternating erasure strategy that includes hardware block erasure and software data overwriting will be generated. If the Sanitize hardware block erasure function is not supported, a software overwrite strategy that only includes software data overwriting will be generated.

4. The cloud-based training data secure erasure method according to claim 3, characterized in that, In step S4 When the erasure strategy is an alternating hardware and software erasure strategy, multiple rounds of alternating hardware and software erasure operations are performed, specifically including: The first round performs the Sanitize hardware block erasure operation. The second round performs a complete overwrite of all zero-value data. The third round involves performing a complete overwrite of all OneValue data. The fourth round involves overwriting all zero-value data. The fifth round of the Sanitize hardware block erasure operation is performed again. The sixth round involves overwriting all zero-value data. When the erasure strategy is a software overwrite strategy, multiple rounds of software overwrite operations are performed, specifically including: The first round performs a complete overwrite of all zero-value data. The second round involves performing a complete overwrite of all OneValue data. The third round involves overwriting all zero-value data. The fourth round involves overwriting all zero-value data. The data overwrite operation bypasses the system cache using direct I / O.

5. The cloud-based training data secure erasure method according to claim 1, characterized in that, In step S4, before performing multiple rounds of secure erasure operations, the following operations are also performed: Destroy the encryption keys corresponding to each training data on the target NVMe solid-state drive to achieve a dual linkage of encryption erasure and physical erasure.

6. The cloud-based training data secure erasure method according to claim 1, characterized in that, Step S5 includes: Step S51: Read sector data from multiple preset points on the target NVMe solid-state drive, verify whether each sector data is zero, and if so, generate a first digital certificate. The first digital certificate includes the device serial number, erasure start timestamp, erasure end timestamp, record of the number of erasure rounds executed, hash value of the verification result of each preset point, and operator digital signature. Step S52: Read the data blocks corresponding to multiple random points of the target NVMe solid-state drive, read the data blocks of each random point and perform integrity verification, and write the hash value of the verification result into the blockchain or an immutable audit log. The multiple random points include the starting position, 1GB offset position, and 10GB offset position of the target NVMe solid-state drive; Step S53: Determine whether the verification results of steps S51 and S52 are both passed. If so, generate a second digital certificate and compliance report containing a complete destruction process record, and update the device status of the target NVMe solid-state drive in the cloud storage resource pool to the destroyed status.

7. The method for securely erasing cloud-based training data according to claim 1, characterized in that, In step S4, when performing multiple rounds of secure erasure operations, the following thermal monitoring operations are also performed: The temperature value of the target NVMe solid-state drive is read in real time. When the temperature value exceeds the preset temperature threshold, the data writing speed of the target NVMe solid-state drive is automatically reduced or the erase task of the target NVMe solid-state drive is paused.

8. The method for securely erasing cloud-based training data according to claim 1, characterized in that, The method supports the parallel execution of multiple secure erase tasks, specifically: Based on the resource usage of the cloud data center, dynamically allocate the number of target NVMe solid-state drives to perform secure erase operations simultaneously; Record the erasure progress of each target NVMe SSD, and execute breakpoint continuation based on the erasure progress.

9. A cloud-based training data secure erasure system, characterized in that, For implementing a cloud-based training data secure erasure method as described in any one of claims 1-8, the system comprises: The device management module is used to obtain the device identifier of the target NVMe solid-state drive, isolate the target NVMe solid-state drive from the cloud storage resource pool and mark it as unwritable; The permission confirmation module, connected to the device management module, is used to verify and record the authorization information and operation log for data destruction when the training data stored in the target NVMe solid-state drive meets the deletion conditions; wherein, the authorization information includes electronic signature authentication data submitted by the user and the cloud administrator respectively; The hardware detection module, connected to the permission confirmation module, is used to send query commands to the target NVMe solid-state drive in batches to obtain the support status of the hardware-level data erasure function, and dynamically generate an erasure strategy based on the returned query results. The erase execution module, connected to the hardware detection module, is used to perform multiple rounds of secure erase operations on the target NVMe solid-state drive according to the erase strategy; wherein the secure erase operation is an alternating hardware and software erase strategy that includes hardware block erasure and software data overwriting, or a software overwrite strategy that only includes software data overwriting.

10. A cloud-based training data secure erasure system according to claim 9, characterized in that, The system also includes: A thermal monitoring module, connected to the erase execution module, is used to read the temperature value of the target NVMe solid-state drive in real time. When the temperature value exceeds a preset temperature threshold, the module automatically reduces the data writing speed of the target NVMe solid-state drive or pauses the erase task of the target NVMe solid-state drive. The verification and audit trail module, connected to the erasure execution module, is used to perform multi-point sampling verification and deep random verification on the erased target NVMe solid-state drive. After the verification is passed, a digital certificate and a compliance report are generated. The resource management module, connected to the verification and audit trail module, is used to receive the verification pass signal output by the verification and audit trail module, update the device status of the target NVMe solid-state drive in the cloud storage resource pool to the destroyed state, and allocate the target NVMe solid-state drive to the redeployment queue or mark it as a device to be retired.

Images