Storage Controller Secure Erasure in Unrecoverable State
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storage devices often become 'bricked' or unrecoverable during data erasure, leaving user data intact, especially when errors occur during the sanitize/secure erase command, posing a risk of data leakage even after physical damage.
Innovation Solution
A controller in the storage device detects unrecoverable errors and enters a restricted firmware mode, loading firmware into a secondary memory device to execute a sanitize operation, ensuring complete erasure of user and control data from the primary memory device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If exception handling is used to recover from errors during data erasure, then the storage device can recover from some errors, but the device may become stuck in an unrecoverable state (bricked) and user data remains on the memory device
Solution Approach 1:
The storage device is divided into two independent memory devices: a first memory device for user data and a second memory device for control data and firmware. This segmentation allows the control operations to be performed independently from user data, enabling secure erasure of user data even when control data becomes corrupted or the device enters an unrecoverable state.
Solution Approach 2:
A sanitize operation is performed on the first memory device before the device is marked as unrecoverable. This preliminary action ensures that user data is erased from the primary storage before the device enters a bricked state, preventing data leakage while maintaining the ability to recover from control data errors.
2Loss of information
If the storage device enters restricted firmware mode to load firmware into a second memory device, then complete data erasure can be achieved, but the device complexity increases
Solution Approach 1:
The firmware is extracted from the first memory device and loaded into the second memory device when the device enters restricted firmware mode. This extraction allows the sanitize operation to be performed on user data without requiring the original firmware to be executed, simplifying the erasure process while maintaining device control.
Solution Approach 2:
The second memory device acts as an intermediary that stores the firmware and enables sanitize operations when the first memory device becomes unrecoverable. This intermediary mechanism allows data erasure to continue without requiring direct access to or modification of the corrupted first memory device's control structures.
3Loss of information
If the host issues a sanitize command to erase data, then user data and metadata can be erased, but errors during control data access may terminate the erasure operation before all user data is erased
Solution Approach 1:
The sanitize operation is executed as a preliminary action before the device enters an unrecoverable state. By performing the erasure operation on user data while the device is still operational, the system ensures complete data removal before control data corruption prevents further operations, thereby maintaining erasure reliability.
Solution Approach 2:
The storage device performs self-service by automatically executing the sanitize operation on its own user data when errors are detected during control data access. This self-service mechanism ensures that the device erases its own data without requiring external intervention, maintaining erasure completion even when normal operation becomes unreliable.
Data Source
AI summary
A storage device ensures erasure of a first memory device even when the storage device is in an unrecoverable state. The storage device includes the first memory device and a controller. The controller executes operations on the first memory device in response to instructions received from a host coupled to the storage device. The controller may detect when an unrecoverable error occurs when executing instructions and enter an exception handling mode. The controller may also determine if the storage device enters an unrecoverable state and may move into a restricted firmware mode when the storage device enters the unrecoverable state. When in the restricted firmware mode, the controller may load firmware into a second memory device and, upon receiving a sanitize instruction from the host, the controller may execute the firmware in the second memory device to delete data in the first memory device.