Cloud Storage Data Clearing Attestation via Tenant-Provided Nonce
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud service providers lack a robust and verifiable process for ensuring the erasure of sensitive data from rented storage resources, leading to potential data exposure when resources are recycled for other tenants.
Innovation Solution
A method where tenants provide a confidential nonce that is hashed and written over the storage data, allowing them to verify through public/private key cryptography that the storage has been properly cleared, with the option to initiate clearing at their chosen time and using a single clear command for efficient data overwrite.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cloud service providers recycle storage resources for other tenants, then resource utilization and productivity are improved, but data security and reliability deteriorate due to potential data exposure
Solution Approach 1:
The system performs data clearing operations before reallocating storage resources to new tenants. A nonce is generated and written to the storage, then overwritten with clear data patterns. This preliminary clearing action ensures that no residual tenant data remains before the storage is reused, thus maintaining security while enabling continuous resource recycling.
Solution Approach 2:
The system implements an attestation mechanism where the tenant receives feedback about the clearing process. The tenant can verify that the storage has been properly cleared by reading back the nonce and comparing it with the clear data patterns. This feedback loop ensures that the clearing operation was successful before resource reallocation, balancing security with productivity.
2Reliability
If traditional data clearing methods are used, then data erasure can be achieved, but the process is complex and lacks verifiability for tenants
Solution Approach 1:
The system enables tenants to perform self-verification of the data clearing process. The tenant provides a nonce that is used to generate clear data patterns, then verifies the clearing by reading back the storage contents and comparing with the expected patterns. This self-service approach eliminates the need for complex external verification systems while ensuring reliable data erasure.
Solution Approach 2:
The system uses a nonce as a template or copy that is hashed and used to generate clear data patterns. Instead of requiring complex clearing verification, the system creates a simplified copy of the clearing process that can be easily verified by the tenant through cryptographic comparison of the nonce hash with the read-back data.
3Reliability
If tenants have control over data clearing timing, then data security is improved, but system automation and ease of operation deteriorate
Solution Approach 1:
The system provides dynamic control over the clearing process timing. Tenants can initiate clearing operations at any time before resource reallocation, and the system adapts the clearing process to the tenant's timing requirements. The nonce-based mechanism allows flexible timing while maintaining security, as the clearing can be performed immediately before allocation or scheduled in advance.
Data Source
AI summary
One or more non-transitory computer-readable media with instructions stored thereon, wherein the instructions are executable to cause one or more processor units to responsive to a data clear command issued by a tenant of a cloud service provider, issue a plurality of write commands to storage locations utilized by the tenant, the write commands to write a value based on an input provided by the tenant to the storage locations; and provide data read from at least a subset of the storage locations for attestation by the tenant of performance of the data clear command.