Providing User Guidance on Erasure Process Selection Based on Accumulated Erasure Reports

According to an aspect, there is provided a method for guiding a user of a first computing device in selecting a suitable erasure process for a second computing device. Initially, information on a plurality of erasure reports describing erasure processes carried out for computing devices is maintained in an erasure report database. A remote computing device receives one or more device parameters characterizing the second computing device from the first computing device. The remote computing system compares the one or more device parameters to device parameters maintained in the erasure report database in response to the receiving and based thereon determines one or more expected erasure process properties for at least one erasure process for erasing a memory or part thereof of the second computing device. The remote computing system sends the one or more expected erasure process properties for said at least one erasure process to the first computing device.

FIELD OF THE INVENTION

The present invention relates to data security and particularly to providing means for providing user guidance for performing an erasure process on a device.

BACKGROUND

The following background description art may include insights, discoveries, understandings or disclosures, or associations together with disclosures not known to the relevant art prior to the present invention but provided by the present disclosure. Some such contributions disclosed herein may be specifically pointed out below, whereas other such contributions encompassed by the present disclosure the invention will be apparent from their context.

A data erasure process for a mobile device or other computing device cannot typically be performed fully automatically. Instead, manual user input needs to be provided to erasure client software for it to successfully perform the data erasure process. To be able to provide the necessary user input specifying, for example, the data erasure process to be used, the person managing said process is often required to have supporting documentation available, some prior knowledge and/or expertise regarding different available data erasure processes. Even if the user operating the process is knowledgeable of the data erasure process, human error may still easily occur, especially if multiple processes are run in parallel by the user. Therefore, it would be beneficial in terms of speed and accuracy of the overall process if more automated means for providing the user with device-specific information on the data erasure process would be available.

BRIEF DESCRIPTION OF THE INVENTION

According to an aspect, there is provided the subject matter of the independent claims. Embodiments are defined in the dependent claims.

One or more examples of implementations are set forth in more detail in the accompanying drawings and the description below. Other features will be apparent from the description and drawings, and from the claims.

DETAILED DESCRIPTION OF EMBODIMENTS

The embodiments to be discussed below seek to facilitate the process of performing data erasure. Data erasure (equally called data sanitization or data wiping) is a software-based process of overwriting and/or obfuscating data which aims to completely destroy and/or render unrecoverable all electronic data residing on a hard disk drive or other digital media. By overwriting the data on all sectors of the storage device and/or changing the encryption key used to encrypt and decrypt the data, the data is rendered unintelligible. Typically, after the data erasure the storage device still remains operable.

Many different government and industry standards and methods have been created for software-based data erasure such as United States Department of Defence (U.S. DoD) 5220.22-M(ECE) and Communications Security Establishment Canada (CSEC) ITSG-06. The different standards (or methods or processes) differ from each other, for example, in the number of times the data is overwritten (e.g., 1-35 passes may be used), the overwrite pattern used and whether a verification that all the data have been removed is required. The overwrite pattern defines which character (e.g., a one, a zero, a pseudo-random character) is used for overwriting in each pass and it may have varying degrees of randomness depending on the method. To give an example of the operation of an erasure process, the CSEC ITSG-06 erasure process performs data erasure in three passes in the following manner:

Pass 1: Overwriting the data with a zero or a one;

Pass 2: Overwriting the data with the complement of the previously written character (e.g., a one if a zero was used in Pass 1); and

Pass 3: Overwriting the data with a pseudo-random character and verifying the (over)write.

In addition to or as an alternative for overwriting, (data) erasure standards may require issuing one or more firmware sanitization commands to the storage device. These commands aim to cause the storage device to perform one or more data erasure functions built into the storage device itself. Available firmware sanitization commands depend on the technology-specific standards, according to which the storage device is designed.

To give an example of a scenario where firmware sanitization commands may be employed, (data) erasure standards may require the encryption key of an encrypting storage devices to be changed (i.e., cryptographic erasure). This may be achieved by issuing one or more specific firmware sanitization command. As a further example, the encryption key of an encrypting storage device designed according to the AT Attachment (ATA) interface standard may be changed by issuing a Crypto Erase EXT command to the encrypting storage device.

Different (data) erasure processes (following a standard or a method) may be most suitable or expedient for different storage devices. For example, a different number of overwrite passes may be required for different storage media to fully ensure that no data can be recovered later. For example, while a single pass may be considered acceptable for some hard disc drives (HDD), for modern flash based storage devices, such as solid state drives (SSD), multiple passes and/or firmware sanitization commands according to the technology-specific standards may often be required to fully ensure that no data can be recovered using forensic analysis. In some cases, multiple acceptable erasure process options may be available, but their properties for a given computing device or storage device may differ, for example, in terms of probability of success and expected duration of the erasure process. For these reasons, it is preferable that a user of an erasure software is given the option to manually select an erasure process from a plurality of different erasure processes and perhaps even to tune some of the erasure process properties associated with selected erasure process. However, making such a selection requires the user to have supporting documentation available and/or to have considerable personal expertise on the different erasure processes and their suitability for different types of storage media. Making a wrong selection may result in wasted time as multiple overwrite passes are conducted when they are not necessary or in the worst case incomplete or insufficient erasure of the data. The embodiments solve or at least alleviate this problem by offering an automated means for providing device-specific information on the erasure processes available to the user (or at least on some of them) to facilitate the decision-making regarding the erasure process selection.

The erasure processes discussed in relation to embodiments may be any known data erasure (or equally sanitization or wiping) processes (following a standard or a method) for erasing data such that it may no longer be recovered by standard data recovery means. For example, the erasure process used may be of one of the following types (the number of passes required given in parentheses, if specified in the corresponding standard or method): Air Force System Security Instruction 5020 (2 passes), U.S. DoD 5220.22-M(ECE) (7 passes), U.S. DoD 5220.22-M(E) (3 passes), U.S. DoE M 205.1-2, German BSI-2011-VS (4 passes), German BSI-GS (1 pass), German BSI-GSE (2 passes), U.K. CESG CPA-Higher Level (3 passes), Blancco Extended Firmware Based Erasure (3 passes), Blancco Firmware Based Erasure (2 passes), HMG Infosec Standard 5, Higher Standard (3 passes), HMG Infosec Standard 5, Lower Standard (1 pass), National Computer Security Center (NCSC-TG-025) (3 passes), Blancco SSD Erasure, Bruce Schneier's algorithm (7 passes), the Gutmann method, British HMG IS5, Canadian RCMP TSSIT OPS-II, Communications Security Establishment Canada ITSG-06, NAVSO-P-5239-26 (3 passes), Russian GOST R 50739-95, U.S. Army AR380-19, U.S. Navy OPNAVINST 5239.1A (3 passes), NIST SP 800-88 Clear or NIST SP 800-88 Purge, NSA 130-1 (3 passes), HMG Infosec Standard 5, Lower Standard (1 pass), HMG Infosec Standard 5, Higher Standard (3 passes), one random pass and 1-pass zero.

An architecture of a communications system to which embodiments of the invention may be applied is illustrated inFIG. 1.FIG. 1illustrates a simplified system architecture only showing some elements and functional entities, all being logical units whose implementation may differ from what is shown. The connections shown inFIG. 1are logical connections; the actual physical connections may be different. It is apparent to a person skilled in the art that the systems also comprise other functions and structures.

FIG. 1illustrates a system100comprising a remote computing system101which is connected via a communications network110to one or more local systems120,130. Each local system120,130comprises at least a first computing device121connected via a first interface126to a second computing device124and via a second interface127to the communications network110(shown inFIG. 1only for the local system120for simplicity). In some embodiments, the first computing device121may be connected via first interfaces126to two or more second computing devices124simultaneously.

The first computing device121is a computing device used for performing a data erasure process (following a standard or a method) for erasing (or equally sanitizing or wiping) data stored to the second computing device124(or specifically, to the memory125of the second computing device124) in a controlled manner. To be able to perform said data erasure process, the first computing device121may be configured, for example, to access information (e.g., device information) stored to the second computing device124, send information (e.g., device parameters) to the remote computing system101via the communications network110using the second interface127, receive information (e.g., expected erasure process properties and/or other process information) from the remote computing system101via the communications network110using the second interface127and erase information stored to the memory125of the second computing device124using a specific data erasure process. Moreover, the first computing device121may comprise at least one user input device122which provides a user of the first computing device121means for inputting information, for example, in connection with the data erasure process. The at least one user input device122may comprise, for example, a keyboard, a touch screen, a mouse and/or a touch pad. The first computing device121further comprises a display123through which the user may be able to monitor the data erasure process. The first interface126may be used, by the first computing device121, at least for retrieving device information from the second computing device124(or specifically from the memory125) and performing the data erasure process. The first computing device121may be connected via the first interface126to the second computing device124using a wire or a cable such as a USB (Universal Serial Bus)-to-USB cable, a USB-to-mini-USB cable or a USB-to-micro-USB cable, using a docking station or wirelessly (e.g., via WiFi or Bluetooth). The first computing device121may be configured to run dedicated erasure client software for guiding a user or an operator of the first computing device121through the erasure process for the second computing device124.

The second computing device124is a computing device comprising a memory125which is to be erased using the first computing device121. The second computing device124may comprise altogether one or more memories of which at least one is to be erased (fully or partly). While the first computing device121may be actively operated by a user or an operator, the second computing device124may be assumed to be only receiving inputs via the first computing device121(that is, not via any possible user input devices of the second computing devices124) during the processes according to embodiments to be discussed in the following.

Each of the first and the second computing device121,124refer to a portable or non-portable computing device (equipment, apparatus). Computing devices which may be employed include wireless mobile communication devices operating with or without a subscriber identification module (SIM) in hardware or in software, including, but not limited to, the following types of devices: desktop computer, laptop, touch screen computer, mobile phone, smart phone, personal digital assistant (PDA), handset, e-reading device, tablet, game console, note-book, multimedia device, sensor, actuator, video camera, car, wearable computer, telemetry appliances, and telemonitoring appliances. The first and second computing devices121,124may be computing device of the same type or of a different type. In a typical non-limiting embodiment, the first computing device121may be a desktop computer or a laptop and the second computing device124may be a mobile device (e.g., a smart phone, a tablet computer or a laptop). In some embodiments, to the second computing device124may be a memory or a storage device, such as a HDD or a SSD. In general, the second computing device124may be any computing device comprising at least one memory and which may be electrically connected to the first computing device121. Said at least one memory may comprise at least one internal memory and/or at least one external memory.

In some embodiments, the first computing device121and the second computing device124may be parts of a single apparatus or the second computing device124may be comprised within the first computing device121. In other words, the first and second computing devices may be fixed together (as opposed to being easily detachable from each other as discussed earlier). For example, the second computing device124may correspond to a memory or a storage device of the first computing device121.

The communications network110may comprise one or more wireless networks, wherein a wireless network may be based on any mobile system, such as GSM, GPRS, LTE, 4G, 5G and beyond, and a wireless local area network, such as Wi-Fi. Furthermore, the communications network110may comprise one or more fixed networks and/or the Internet.

The remote computing system101is a device configured to receive information (e.g., device information, such as one or more device parameters, characterizing the computing device) regarding second computing devices124from first computing devices121connected to it via the communications network110, analyze the received information and send analysis results (e.g., expected erasure process properties characterizing an erasure process and/or other erasure guidance information) to the first computing devices121via the communications network110. The analysis may be carried out specifically by an erasure analysis unit or apparatus of the remote computing system (not shown inFIG. 1) and/or may be based on information stored to an erasure report database103. The erasure report database103may comprise at least information on a plurality of erasure reports describing erasure processes carried out by first computing devices on second computing devices (to be described in detail in relation to further embodiments).

The other erasure guidance information sent to the first computing devices121by the remote computing system101may comprise statistical information on the erasure processes carried out for a plurality of computing devices. For example, the other erasure guidance information may comprise the probability of occurrence of each erasure process among all erasure processes described in the plurality of erasure reports maintained in the erasure report database. According to an embodiment, the other erasure guidance information comprises the probability of occurrence of the most common erasure process described in the plurality of erasure reports. According to another embodiment, the other erasure guidance information comprises the probability of occurrence of a pre-defined number of most common erasure processes (e.g., the probability of occurrence of the two most common erasure processes). This embodiment provides the advantage that the user may make the selection regarding the erasure process guided by the preferences of previous erasure processes.

The remote computing system101may be equally called a remote server or a server as the first computing device121and the remote computing system may be seen as forming a client-server relationship. Similarly, the first computing device121may be equally called a local client or a client.

The remote computing system101may be fully or partly cloud-based, that is, the remote computing system101may be or comprise at least one computing cloud. Specifically, the erasure analysis unit and/or the database may be cloud-based.FIG. 2illustrates signaling, according to embodiments for providing a user with information on one or more (device-specific) expected erasure process properties for at least one erasure process for erasing a memory or part thereof of a second computing device and performing the erasing using a first computing device. The illustrated processes may be carried out using a system101ofFIG. 1. While the illustrated process (and also the following illustrated processes) are discussed for a first computing device acting on a single second computing device, in other embodiments multiple second computing devices may be handled by the first computing device in a similar manner simultaneously (i.e., in parallel).

According to an embodiment, the first computing device121is connected to multiple second computing devices124via USB (Universal Serial Bus) interface126using a USB hub. This embodiment provides the advantage that the number of USB ports in the first computing device may be fewer than the number of second computing devices handled by the first computing device. According to an embodiment, the USB hub is a 10-port USB hub.

Referring toFIG. 2, it is initially assumed that the remote computing system maintains, in block201, in an erasure report database information on a plurality of erasure reports describing erasure processes carried out for a plurality of computing device. Each erasure report comprises information on the type of erasure process which was used for erasing a memory or part thereof of a computing device, one or more erasure process properties for the completed erasure process and one or more device parameters characterizing (or defining) the computing device for which the erasure process was carried out. The type of the erasure process may be, for example, one of the types listed above. The one or more erasure process properties of an erasure process may specifically be properties of the erasure process recorded during or after the completion of the erasure process. The one or more erasure process properties in a given erasure report may comprise one or more of a duration of the erasure process and an outcome (i.e., success/failure) of the erasure process. The duration of the erasure process may be provided as the total duration and/or the (average) duration per overwrite pass. Moreover, the type of the erasure process may be considered, alternatively or in addition, as one of said one or more erasure process properties. If the erasure process was a failure, the one or more erasure process properties in the associated erasure report may only comprise information on the failure (i.e., not, for example, information on the duration of the erasure process). The one or more device parameters for a given computing device may comprise, for example, one or more of a manufacturer, a model, a year or date of manufacture, International Mobile Equipment Identity (IMEI), a device identifier other than IMEI, hardware information (e.g., component information) and memory usage. A more comprehensive list of possible erasure process properties and device parameters is provided after the discussion onFIG. 2.

The process for guiding a user in selecting an erasure process for erasing a memory or part thereof of a second computing device starts when a first computing device retrieves, in messages202, one or more device parameters characterizing the second computing device electrically connected to the first computing device from a memory of the second computing device. According to an embodiment, in addition to retrieving one or more device parameters from a memory of the second computing device, the first computing device also retrieves one or more further device parameters from a remote computing system, where these parameters are maintained in a database. According to an embodiment, said further device parameters are maintained in the same remote computing system where erasure reports are maintained in the erasure report database.

The one or more device parameters may be defined as described above in relation to the contents of an erasure report. The retrieving may specifically comprise sending, by the first computing device, a request for device parameters to the second computing device and in response to receiving the request in the second computing device, retrieving, by the second computing device, the one or more device parameters from a memory of the second computing device and sending them from the second computing device to the first computing device. After the retrieving, in messages202, the first computing device sends, in message203, all or some of the one or more device parameters characterizing the second computing device via a communications network to a remote computing system. The all or some of the one or more device parameters may be sent within a separate request for expected erasure process properties for the second computing device and for at least one erasure process or as a part of regular reporting operation of the first computing device. In some alternative embodiments, the second computing device may send one or more of its own device parameters (via the communications network) to the remote computing system. In some embodiments, the retrieving in block202may be initiated automatically in response to the second computing device being electrically connected to the first computing device.

In response to receiving, in block204, the all or some of the one or more device parameters characterizing (or defining) the second computing device from the first computing device via the communications network, the remote computing system compares, in block204, these received one or more device parameters to device parameters comprised in the plurality of erasure reports maintained in the erasure report database. Specifically, the remote computing system may compare a set of the received one or more device parameters to corresponding sets of one or more device parameters in the plurality of erasure reports to find one or more erasure reports relevant for the second computing device. The comparing may comprise, for example, looking for matches for the one or more device parameters of the second computing device from the plurality of erasure reports. The matches may be required to be full matches and/or close or partial matches (e.g., at least some device parameters match the one or more device parameters of the second computing device or a set of device parameters are correlated with the one or more device parameters of the second computing device to certain degree). The erasure reports with matching device parameters are considered relevant (or applicable or pertinent) for the second computing device as they correspond to the same or similar computing devices as the second computing device. As certain device parameters may not be equally important from the point of view of all erasure processes, the comparing may be conducted differently for different erasure processes. For example, different set of device parameters may be compared and/or different weighting for different device parameters may be applied in the comparing so as to find relevant erasure report(s) for different erasure processes. The comparing procedure according to an embodiment is to be described in more detail in connection withFIG. 3.

Based on the comparing in block204or more specifically on one or more erasure process properties of the one or more relevant erasure reports, the remote computing system determines, in block205, one or more expected erasure process properties and/or other erasure guidance information for each of at least one erasure process (preferably, each of a plurality of erasure processes) for erasing the memory or part thereof of the second computing device. Each set of one or more expected process properties may be specific to the second computing device (and to devices of the same type as the second computing device), that is, they may be device-specific as well as erasure process-specific. One or more expected erasure process properties defining a particular erasure process of said at least one erasure process for the second computing device may comprise, for example, a probability of success of the erasure process (when carried out for that particular computing device) and/or an expected duration of the erasure process (for that particular computing device). The determining of the one or more expected erasure process properties may comprise, for example, analyzing set(s) of erasure process properties associated with the set(s) of one or more device parameters deemed relevant based on the comparing (e.g., being full matches or partial matches) using one or more of statistical analysis methods (e.g., correlation analysis), extrapolation, interpolation, averaging and calculating a median or a mode. The determining of the one or more expected erasure process properties may be carried out separately for each erasure process which is applicable for erasing the memory or part thereof of the second computing device and/or for which relevant erasure reports are available in the erasure report database. For example, the probability of success for a particular erasure process may be evaluated by simply comparing the number of successful erasures to the total number of erasure attempts (i.e., successful or failed erasures) and the expected duration of the erasure process may be evaluated by taking an average of the duration of successful runs of the erasure process. Obviously, only erasure reports deemed relevant based on the comparing should be taken into account in these calculations. The one or more expected erasure process properties may, in addition or alternatively, comprise information on whether the erasure process in question is suitable for the second to computing device (and if not, no other information may be provided).

Once the remote computing system has determined the one or more expected erasure process properties for said at least one erasure process, it sends, in message206, information on the one or more expected erasure process properties for said at least one erasure process to the first computing device via the communications network. In some embodiments, the remote computing system may further send information on each erasure process for which said one or more expected erasure process properties could not be determined. Said information on each erasure process may comprise simply an indication that the determining of the expected erasure process properties failed and possibly a reason for the failure (e.g., the erasure process being not applicable for erasing the memory or part thereof of the second computing device and/or relevant erasure reports being unavailable in the erasure report database).

The first computing device receives, in block207, at least the information on the one or more expected erasure process properties and/or other erasure guidance information and subsequently (or consequently) displays, in block207, said information to a user via a display of the first computing device. By providing the one or more expected erasure process properties for said at least one erasure process to the first computing device and displaying them to the user of the first computing device, the decision making regarding which erasure process to perform for erasing the memory or part thereof of the second computing device using the first computing device is facilitated as the user is able to clearly observe the advantages and disadvantages of each erasure process.

In response to receiving a user input confirming a selection of an erasure process (of said at least one erasure process for which device-specific erasure process information was provided) via a user input device of the first computing device, the first computing device performs, in messages209, the selected erasure process for erasing the memory or part thereof of the second computing device. The first computing device may also record, in messages209, erasure process properties for the selected erasure process.

The processes according to embodiments provide the advantage that since device and erasure process-specific information on the expected erasure process properties and/or other erasure guidance information are provided to the user of the first computing device, the user of the first computing device is capable of making more informed and expedient decisions regarding the selection of the erasure process since the decision on the erasure process selection does not depend solely on the expertise of the user. The erasing of memories or parts thereof of second computing devices is thus facilitated.

It should further be noted that while an experienced user of the first computing device (or specifically of the erasure client software running in the first computing device) may be able to provide a rudimentary estimate for at least some of the one or more expected erasure process properties (e.g., probability of success) based on his/her expertise, there may be unforeseen factors affecting at least some of the one or more expected erasure process properties which may be difficult to notice by the user but which may be easily detected by the process according to embodiments. Such unforeseen factors could be, for example, undocumented (or unannounced) memory component variations within seemingly similar devices. Switching the flash memory chip type, for example, could affect the speed at which the memory may be read and written, hence affecting the duration of a data erasure process. The flash memory chip type may be, in this case, one of the device parameters.

In some embodiments, the one or more erasure process properties comprised in each erasure report may comprise one or more of the following: a time stamp for the erasure report, a start time for the erasure process, an end time for the erasure process, a duration of the erasure process, name and/or type of the erasure process used, overwriting rounds (i.e., overwriting passes) used, firmware sanitization commands used, firmware sanitization command rounds used, total erasure rounds used, and an outcome of the erasure process.

In some embodiments, the one or more device parameters retrieved by the first computing device and/or comprised in each erasure report may comprise one or more of the following hardware-related information regarding the device in question: a name of the manufacturer, a name, a model, an identifier for the device, IMEI, a serial number, an internal model, chassis type, a rooting (e.g., rooted/not rooted), a (clock) speed of the processor of the computing device, a manufacturer of the processor of the computing device, a model of the processor of the computing device, and information on at least some of one or more memories of the computing device. Said information on at least some of one or more memories of the computing device may comprise, for example, a name for each or some of one or more memories of the device, capacity for each or some of said one or more memories (given, e.g., in megabytes), type of each or some of said one or more memories, a serial number for each or some of said one or more memories and/or a vendor for each or some of said one or more memories. In some embodiments, the one or more to device parameters retrieved by the first computing device and/or comprised in each erasure report may further comprise one or more of the following software-related information regarding the device in question: a name of the operating system, a version of the operating system, a software used for performing the erasure process and a version of said software used for performing the erasure process. In an exemplary non-limiting embodiment, the one or more device parameters retrieved by the first computing device and/or comprised in each erasure report comprise at least information on the clock speed of the processor of the computing device, a type of each or some of said one or more memories of the computing device and a capacity of each or some of said one or more memories of the computing device. In some embodiments, the one or more device parameters retrieved by the first computing device and/or comprised in each erasure report may comprise the age of the computing device or the effective age of the computing device (evaluated, for example, based on capacity deterioration of battery of the computing device).

FIG. 3illustrates a process performed by a remote computing system according to an embodiment for providing a user with information on one or more (device-specific) expected erasure process properties for at least one erasure process for erasing a memory or part thereof of a second computing device. The illustrated process is an alternative to the process carried out by the remote computing system in blocks201,204,205and message206ofFIG. 2. The illustrated process may be carried out by the remote computing system101ofFIG. 1. Unless otherwise stated, the definitions given in relation previous embodiments may apply also here.

Similar toFIG. 2, it is initially assumed in block301that the remote computing system maintains information on a plurality of erasure reports in an erasure report database. The remote computing system receives, in block302, information on one or more device parameters characterizing a second computing device from a first computing device via a communications network. Blocks301,302may correspond to blocks201,204(“receive” only) ofFIG. 2.

In the embodiment illustrated inFIG. 3, the comparing described in relation to block204ofFIG. 2is divided into blocks303to308. In a pre-processing phase, the remote computing system identifies, in block303, a device category of the second computing device based on the one or more device parameters received from the first computing device. The device category may be one of the device parameters or it may be identified based on the one or more device parameters. The available device categories may comprise, for example, a mobile phone (or a smart phone), a tablet computer, a desktop computer, a laptop, a mass media storage, a smart watch, a digital still camera, a digital video camera, a mobile Internet device, a personal digital assistant (PDA), a handheld game console, a calculator and a personal navigation device or any subset of said categories. In one embodiment, the available device categories are a mobile device, a desktop computer and a laptop.

In some embodiments, the device categories may be defined in a more limited manner. For example, the device categories may be specific to a certain manufacturer, that is, a Samsung smart phone and Apple smart phone may be defined to be different device categories. Similar limitation based on some other device parameter (e.g., memory type or operating system) may be applied in other embodiments.

The remote computing system generates, in block305, a vector based on at least one of the one or more device parameters for each of at least one erasure process. Each element of each vector may have a numerical value corresponding to a particular feature or features of the second computing device. Said at least one of the one or more device parameters based on which the vector is generated may comprise only device parameters which are considered relevant or significant in terms of the operation of that particular erasure process. Different device parameters may not be equally important for all erasure processes. For example, memory type and size may be significant device parameters for erasure processes that use overwriting while operating system may play a bigger role for cryptographic erasure (or crypto erase) processes that do not employ overwriting. Each element of a vector may correspond directly to a device parameter or it may be generated based on one or more device parameters (e.g., if the device parameter does not have a numeric value and/or if multiple device parameters are used for generating the element).

For example, the second computing device may contain according to its device parameters five storage media which have the following capacities: 1 GB, 2 GB, 3 GB, 4 GB, and 5 GB. From these device parameters, the remote computing system may form a three-element vector [15 5 3], where the first element (15) corresponds to the total size in gigabytes, the second element (5) corresponds to the number of storage media and the third element (3) corresponds to the average size of storage media.

For each of said at least one erasure process, the remote computing system compares, in block306, the vector associated with the second computing device (and with said erasure process) to one or more corresponding vectors which were generated for one or more computing devices of the plurality of computing devices based on device parameters in the plurality of erasure reports. Here, the one or more computing devices may be specifically computing devices of the same device category as the second computing device. The one or more corresponding vectors may be generated after (or simultaneously with) the generation of the vector for the second computing device. Alternatively, each of the one or more corresponding vectors may have been generated earlier, for example, when expected erasure process properties were determined for performing an erasure process for that particular computing device or when an erasure report for that particular computing device was received by the remote computing system. A single vector or multiple vectors may be defined for each computing device depending on whether an erasure process has been carried out for that particular computing device once or multiple times. Similar to the vector(s) of the second computing device, the one or more vectors for which the vector(s) of the second computing device are compared may also be specific to a particular erasure process.

In some embodiments, the comparing in block306may specifically comprise calculating, for each vector of the second computing device associated with a particular erasure process, a value of a distance metric quantifying the difference (or distance) between the vector of the second computing device and corresponding one or more vectors of other computing devices (of the same device category). The distance metric may be the Euclidean distance d which may be calculated using the equation

where i is the index, n is the number of elements in each vector, q=[q1q2. . . qn] is the vector of one of the one or more computing devices associated with the plurality of erasure reports and p=[p1p2. . . pn] is the vector of the second computing device. Instead of the Euclidean distance, the difference between two vectors may be quantified using another (distance) metric. For example, a weighted Euclidean distance may be employed. The weighted Euclidean distance dwmay be defined using the equation

where wiare weighting factors which may be defined independently for each vector element (i.e., for each index i). Different set of weighting factors may be used to for different erasure processes. To give another example, standardized Euclidean distance may also be employed.

Based on the comparing in block306, the remote computing system determines, in block307, whether one or more of the one or more vectors associated with the same device category as the second computing device match the vector of the second computing device according to pre-defined criteria. Specifically, the pre-defined criteria may define that a value of the distance metric between the vector of the second computing device and the matching vector should be below a predefined (upper) threshold.

If no matches are found in block307, the remote computing system may send, in block311, information on the failure to determine expected erasure process properties to the first computing device via the communications network. In some embodiments, block311may be omitted.

If one or more matches according to pre-defined criteria is found (for any erasure process) in block307, the remote computing system selects, for each of at least one erasure process, one or more erasure reports associated with said one or more matching vectors (matching the vector of the second computing device) as a classification cluster for the second computing device. The classification cluster may be defined separately for each erasure process. The classification cluster for a particular erasure process represents a set of erasure reports whose relevant device parameters match the corresponding device parameters of the second computing device to a sufficiently high degree for that particular erasure process. The classification cluster(s) may correspond to the one or more relevant erasure reports as discussed in relation to block204ofFIG. 2.

The remote computing system determines, in block309, one or more expected erasure process properties and/or other erasure guidance information for at least one erasure process (preferably, a plurality of erasure processes) for erasing the memory or part thereof of the second computing device based on erasure process properties described in the one or more erasure reports in the classification cluster. The one or more expected erasure process properties and how they are derived from the erasure process properties in the erasure report database may be defined similar to as described in relation toFIG. 2. In this case however, the determination in block309is limited to the classification cluster and may be based on, alternative or in addition to the one or more erasure process properties comprised in each relevant erasure report, to vectors associated with the classification cluster (which were derived based on said one or more erasure process properties).

In some embodiments, the comparing described in relation to blocks303to308(and/or block204ofFIG. 2) may be insensitive to different erasure processes. According to such embodiments, the determination of one or more expected erasure process properties described in relation to block309(and block205ofFIG. 2) comprises one or more calculation steps following the comparison. First, the remote computing system may generate a single general vector based on at least one of the one or more device parameters (received from the first computing device) without taking into account each of at least one erasure processes separately as described in relation to block305. Second, similar to as described in relation to block306, the general vector may then be compared to one or more corresponding vectors generated for one or more computing devices. Third, similar to as described in relation to block307, the remote computing system may then select one or more erasure reports associated with matching vectors as a classification cluster for the second computing device. Finally, said calculation step following the comparison may comprise averaging and/or other type of scalar operations (as opposed to vector operations) of the one or more erasure process properties comprised in each relevant erasure report, for example. This embodiment provides the advantage that fewer vectors will have to be generated to determine the one or more expected erasure process properties for each of said at least one erasure process.

Also similar to the embodiment ofFIG. 2, once the remote computing system has determined the one or more expected erasure process properties for said at least one erasure process, it sends, in message310, information on the one or more expected erasure process properties for said at least one erasure process to the first computing device via the communications network.

In some embodiments, the pre-processing described in relation to block303(i.e., identifying the device category) may be omitted. Subsequent analysis in blocks306to309may, in those cases, be carried out irrespective of the device categories associated with the second computing device and the plurality of erasure reports. In other words, instead of analyzing only erasure reports corresponding to the same device category (e.g., a smart phone) as the second computing device, all of the plurality of erasure reports (and corresponding vectors) may be involved in blocks306to309.

FIG. 4illustrates a process performed by a first computing device according to an embodiment for erasing a memory or part thereof of a second computing device electrically connected to the first computing device guided by information on one or more (device-specific) expected erasure process properties for at least one erasure process provided by a remote computing device. The illustrated process is an alternative to the process carried out by the first computing device in messages202,203,209and blocks207,208ofFIG. 2. The illustrated process may be carried out by the first computing device121ofFIG. 1. Unless otherwise stated, the definitions given in relation previous embodiments may apply also here.

Referring toFIG. 4, the illustrated process corresponds in many aspects to the processes performed by the first computing device inFIG. 1. Actions pertaining to blocks401,402may be carried out as described in relation to messages201,202ofFIG. 2. In response to receiving one or more expected erasure process properties and/or other erasure guidance information for at least one erasure process for erasing the memory or part thereof of the second computing device from the remote computing system via the communications network in block403, the first computing device displays, in block410, information on the one or more expected erasure process properties and/or other erasure guidance information for each of said at least one erasure process to a user via a display of the first computing device. The information on the one or more expected erasure process properties for said at least one erasure process may also be stored to a database connected to or comprised in the first computing device. The one or more expected erasure process properties may be defined as described in relation toFIG. 1. In response to failing to receive any expected erasure process properties from the remote computing system in block403but receiving information on a failure to determine any expected erasure process properties in block404, the first computing device displays, in block405, information on the failure to the user via the display of the first computing device. If neither information is received in blocks403,404(e.g., within a pre-defined time limit), the process may proceed directly to block406skipping block405/410(i.e., the displaying).

In response to receiving a user input confirming a selection of an erasure process via a user input device of the first computing device in block406, the first computing device performs, in block407, the selected erasure process for erasing the memory or part thereof of the second computing device. The first computing device may also record, in block407, erasure process properties for the selected erasure process. In the ideal case, the user may make the selection regarding the erasure process guided by the one or more expected erasure process properties provided for at least one erasure process. However, if no expected erasure process properties and/or other erasure guidance information were received in block403, the user may have to make the selection based purely on his/her own expertise. The user may also be allowed to make the selection of the erasure process and initiate the erasure process without having to wait for any (possible) expected erasure process properties to be received.

In response to the selected erasure process concluding, the first computing device generates, in block408, an erasure report for the erasure process which was carried out for the second computing device. The erasure report may be defined as described above in relation toFIG. 2, that is, it may comprise at least the one or more device parameters of the second computing device and one or more erasure process properties pertaining to the completed erasure process (i.e., recorded for the selected erasure process when it was carried out for the second computing device). The one or more erasure process properties may comprise at least information on the outcome (i.e., a success or a failure) of the erasure process. If the selected erasure process was successful, the first computing device may include in the erasure report, in addition to the information on the outcome of the erasure process, one or more further erasure process properties. The one or more further erasure process properties may comprise at least a duration of the erasure process (e.g., given as total duration of the erasure process and/or duration of the erasure process per pass). In some embodiments, the one or more further erasure process properties may comprise one or more of the erasure process properties listed in relation toFIG. 2. If the outcome of the erasure process was negative, the user may be prompted to repeat the erasure of the memory or part thereof of the second computing device, possibly using another erasure process.

Finally, the first computing device sends, in block409, the generated erasure report for the completed erasure process to the remote computing system via the communications network.

FIG. 5illustrates a simple process for maintaining the erasure report database using the remote computing system. The remote computing system may be the remote computing system101ofFIG. 1and the erasure report database may the erasure report database103ofFIG. 1. The illustrated process may be carried out in parallel with the processes ofFIGS. 2 and/or 4pertaining to the remote computing system or a part of said processes.

Similar to previous embodiments, it is initially assumed in block501the remote computing system maintains information on a plurality of erasure reports in an erasure report database. In response to receiving an erasure report for an erasure process performed for a second computing device from a first computing device via a communications network in block502, the remote computing system stores, in block503, the received erasure report to the erasure report database. In some embodiments, the remote computing system may also send an acknowledgment acknowledging the successful reception of the erasure report.

As the erasure report database is constantly being updated with new erasure reports, the accuracy of the one or more expected erasure process properties provided by the remote computing system to the first computing device (e.g., in message206ofFIG. 2) increases over time. Therefore, the one or more expected erasure process properties determined for a second computing device (e.g., in block205ofFIG. 2) may be different depending on when the determining of the one or more expected erasure process properties is performed (that is, depending on how many relevant erasure reports exist in the erasure report database at that time). This way also a release of an updated version (i.e., a hardware revision) of a particular second computing device and dynamic changes in existing second computing devices such as updating to a new version of an operating system (or to a completely new operating system) for a particular second computing device may be taken into account automatically over time. While initially the one or more expected erasure process properties may be determined based on the erasure reports for the previous version of that particular second computing device or of the operating system, once erasure reports concerning the new version of that particular second computing device or of the operating system start being accumulated possible changes in any expected erasure process properties are quickly taken into account in the determining of the expected erasure process properties by the remote computing system.

In some embodiments, the first computing device may be configured to perform any of the processes described in relation toFIGS. 2 to 5simultaneously for multiple second computing devices electrically connected to the first computing device (that is, the same first computing device).

In the following, an exemplary use case for the embodiments from the point of view of an operator of a first computing device is discussed.

1. Paavo, erasure technician operating a first computing device according to embodiments, receives a batch of mobile phones (i.e., second computing devices according to embodiments) which need to be erased in accordance with an erasure process that fulfils “NIST Purge” level requirements as defined by NIST SP 800-88 R1, Guidelines for Media Sanitization. He sees that the shipment contains dozens of phones with different models from various manufacturers.

2. Paavo moves the shipment of mobile device next to his erasure station (i.e., the first computing device) with erasure client software providing intelligent guidance using a cloud service (i.e., using a remote computing system being specifically a cloud-based system).

3. Paavo starts to plug in devices and sees how the devices show up in the graphical user interface of the erasure station. In the background, a remote cloud service starts to process the devices' data (i.e., the one or more device parameters for each device) to provide him with guidance information that helps him to better schedule his work. He sees that each of the connected mobile phones goes into a pre-processing state (i.e., a device category is identified).

4. After a short time, Paavo sees in the graphical user interface that the expected erasure process properties for the mobile phones are being received from the cloud service. He sees the predicted success rate and estimated erasure time for the different erasure processes (or at least for one or more available erasure processes fulfilling “NIST Purge” level requirements).

5. The estimates provided by the cloud service (i.e., the remote computing system) look promising, except for one mobile phone. The expected erasure process properties for that mobile phone show that the expected erasure duration is unexpectedly long and the predicted success rate is poor.

6. Paavo takes a closer look at the phone's details (e.g., its device parameters) and because of his expertise he instantly notices that it is a part of a known bad patch of phones from a specific manufacturer. He decides that it is not worth handling the phone and discards it from the process.

7. The rest of the batch of mobile phones is good to go, so Paavo starts an erasure process fulfilling the “NIST Purge” level requirements, notes down the estimated completion time and carries on with his other work.

8. When the time is close to the estimated completion time, Paavo returns to the erasure station and sees that every device has finished with a successful completion of the erasure process.

FIG. 6illustrates an apparatus601configured to perform the functions described above in connection with a remote computing system such as remote computing system101shown inFIG. 1. The apparatus may be an electronic device comprising electronic circuitries. The apparatus may be a separate network entity or a plurality of separate entities. The apparatus may comprise a control circuitry620, such as at least one processor, and at least one memory630including a computer program code (software)631wherein the at least one memory and the computer program code (software) are configured, with the at least one processor, to cause the apparatus to perform any one of the embodiments of the remote computing system described above. The apparatus may comprise at least one database632which may comprise at least the erasure report database as described in relation to above embodiments.

The memory630may comprise a database632which may correspond to the erasure report database, as described in previous embodiments. The memory630may also comprise other databases which may or may not be related to the described erasure process estimation functionalities according to embodiments.

Referring toFIG. 6, the control circuitry620may comprise at least erasure profiler circuitry621. The erasure profiler circuitry621may be configured, for example, to perform at least some of blocks201,204,205and message206ofFIG. 2, blocks301to311ofFIG. 3and blocks501to503ofFIG. 5.

FIG. 7illustrates an apparatus701configured to perform the functions described above in connection with a first computing device, such as the first computing device121ofFIG. 1. The apparatus may be an electronic device comprising electronic circuitries. The apparatus may be a separate network entity or a plurality of separate entities. The apparatus may comprise a control circuitry720such as at least one processor, and at least one memory730including a computer program code (software)731wherein the at least one memory and the computer program code (software) are configured, with the at least one processor, to cause the apparatus to perform any one of the embodiments of the first computing device described above. The apparatus701may comprise, similar to the first computing device121ofFIG. 1, a user input device and/or a display (not shown inFIG. 7).

The memory730may comprise a database732which may comprise, for example, information on one or more device parameters of one or more (second) computing devices electrically connected to the apparatus701, expected erasure process properties for one or more different combinations of a computing to device (targeted for erasure) and an erasure process and/or one or more erasure reports generated by the apparatus. The memory730may also comprise other databases which may or may not be related to the functionalities of the first computing device according to any of presented embodiments.

Referring toFIG. 7, the control circuitry720may comprise erasure analysis circuitry721configured to provide the first computing device functionalities for retrieving the device parameter(s) of the (second) computing device targeted for erasure and providing analysis results regarding erasure processes for erasing a memory or part thereof of the second computing device to a user based on communication with a remote computing system and generating and sending to the remote computing system erasure reports according to any of presented embodiments. The control circuitry may further comprise erasure circuitry722configured to perform the selected erasure process. For example, the erasure analysis circuitry721may be configured to perform at least some of messages202,203and/or blocks207,208ofFIG. 2and/or blocks401to406,408to410ofFIG. 4. Moreover, the erasure circuitry722may be configured to perform at least messages209ofFIG. 2and/or block407ofFIG. 4. In some other embodiments, the control circuitry720may be divided into three or more or only a single individual circuitry.

The apparatuses601,701described in relation toFIGS. 6 and 7may further comprise (communication) interfaces610,710comprising hardware and/or software for realizing communication connectivity according to one or more communication protocols. The communication interface may provide the apparatuses with communication capabilities to communicate via a communications network and enable communication, for example, in the case of the apparatus601ofFIG. 6with one or more (first) computing devices and in the case of the apparatus701ofFIG. 7with a remote computing system. In the case of the apparatus701ofFIG. 7, the communication interfaces710may provide a connection to one or more second computing devices, for example, using any means discussed in relation toFIG. 1.

The communication interfaces610,710may comprise standard well-known components such as an amplifier, filter, frequency-converter, (de)modulator, and encoder/decoder circuitries and one or more antennas.

The memories630,730of the apparatuses601,701described in relation toFIGS. 6 and 7may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, flash memory, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory.

In an embodiment, at least some of the processes described in connection withFIGS. 2 to 5may be carried out by an apparatus comprising corresponding means for performing at least some of the described processes. Some example means for performing the processes may include at least one of the following: detector, processor (including dual-core and multiple-core processors), digital signal processor, controller, receiver, transmitter, encoder, decoder, memory, RAM, ROM, software, firmware, display, user interface, display circuitry, user interface circuitry, user interface software, display software, circuit, antenna, antenna circuitry, and circuitry. In an embodiment, the at least one processor, the memory, and the computer program code form (processing) means or comprises one or more computer program code portions for performing one or more operations according to any one of the embodiments ofFIGS. 2 to 5or operations thereof.