Solid state storage data destruction

A system and method of permanently erasing the contents of a Solid-State Drive (SSD) which involves the destruction of the storage portion of the SSD by rapidly heating that portion of the SSD to a state at which the semiconductor devices which make up the SSD are destroyed or damaged. The system and method allows a user to locally or remotely erase a SSD drive to prevent the contents of the drive from being compromised. Certain embodiments of the system and method provide for the automatic destruction of the SSD should the device be connected to an unregistered drive controller.

FIELD

The present disclosure relates generally to systems and methods for destroying or otherwise rendering a solid-state storage device unusable and its data permanently unrecoverable.

BACKGROUND

Portable computing devices, such as smartphones, tablet computers, and laptop computers (and even some less portable devices, such as, but not limited to, enterprise servers, network appliances, and desktop computers) are incorporating solid-state storage devices in place of conventional rotating disk drives. These solid-state storage devices can include various permanent and semi-permanent storage devices including, but not limited to such electronic devices as, electrically erasable programmable read-only memory (EEPROMs), flash memory, and solid-state drives (SSDs). This trend is likely to accelerate as the cost of solid-state storage continues to fall while their capacity increases. SSDs in particular have many advantages over rotating disk drives including decreased susceptibility to physical shock damage, no rotating or otherwise mechanical devices to wear out or replace, reduced power requirements, greater data storage and retrieval speeds, and smaller size.

Particularly in the case of portable devices, it is often desirable to be able to completely erase data stored on the device, such as when a device has been lost or stolen. In such cases, any type of remote deletion of data is limited and can result in the possibility that some data is recoverable. Physical destruction of memory components remains the most reliable method to ensure that sensitive data is not recoverable from the device. With conventional rotating disk drives, the data contained on the drive can be erased by exposure to a strong magnetic field. However, solid-state drives are resistant to magnetic fields and as such, are not easily and reliably erased by such methods. Alternately, the disk or disks that make up the data storage component of a conventional rotating disk drive can be physically destroyed, for example by crushing, grinding, or shredding the platters of the drive. SSDs are unfortunately not as easily erased. Because of their size, SSDs are frequently incorporated deeply into the structure of portable electronic devices. This makes it difficult, if not impossible, to physically destroy the SSD without also completely destroying the portable electronic device. And in some situations, data on an SSD may even survive a physical destruction attempt. Additionally, in the case of stolen or lost devices, physical access is not available.

Therefore it is appreciated that a need exists for systems and methods for reliably destroying the data found on a SSD device without having to completely destroy the computing device associated with the SSD device.

SUMMARY

In some embodiments, an induction coil is positioned such that an energy pulse applied to the coil causes electronic components of a solid-state drive (SSD) to heat to a temperature sufficient to cause components within the device to melt or fracture, physically destroying the device's operating capability. Thus, heating the SSD causes data stored on the SSD to be permanently lost and render the SSD permanently inoperable. A capacitor or other energy storage device may be electrically connected to the induction coil. Such a capacitor or other energy storage device can be selected such that it provides enough energy to the induction coil to cause the coil to heat to a temperature sufficient to destroy or damage the SSD.

In an exemplary embodiment, a solid-state drive (SSD) destruction system is provided. The system comprises an induction coil proximate to a SSD; and energy storage device; a switch device operably connected to the induction coil and the energy storage device; and, a controller in communication with the switch device, wherein the controller is configured to control the switch device to regulate energy discharged from the energy storage device into the induction coil such that heat generated by the discharged energy is sufficient to destroy data stored in the SSD.

In another embodiment, a method for automatically destroying a SSD is provided. The method comprises: receiving a SSD destruction command; determining a charge level of an energy storage device; and, operating a switch device to regulate energy discharge from the energy storage device to an induction coil proximate to a SSD, such that the heat generated by the energy discharge is sufficient to destroy data stored in the SSD.

In yet another embodiment, a SSD destruction system is provided. The system comprises: an induction coil proximate to a SSD, the SSD having an enclosure and an enclosure intrusion detection device; an energy storage device; a switch device operably connected to the induction coil and the energy storage device; and, a controller in communication with enclosure intrusion detection device and the switch device, wherein when the enclosure intrusion detection device detects an intrusion of the SSD enclosure, the controller is configured to control the switch device to regulate energy discharged from the energy storage device into the induction coil such that heat generated by the discharged energy is sufficient to destroy data stored in the SSD.

The above and other aspects and advantages of the present disclosure will become more readily apparent from the following detailed description and illustrative embodiments thereof, which is to be read in connection with the accompanying drawings.

DETAILED DESCRIPTION

Aspects and implementations of the present disclosure will be understood more fully from the detailed description given below and from the accompanying drawings of the various aspects and implementations of the disclosure. This should not be taken to limit the disclosure to specific aspects or implementations, but explanation and understanding only.

With reference toFIG. 1, a SSD destruction system100may comprise a controller102, a capacitor104or other energy storage device, and an induction or heating coil106, e.g. a flat plane induction coil. The SSD destruction system100is associated with a SSD storage110which may need to be destroyed. In certain embodiments the SSD destruction system100may be integrated with the SSD components, e.g. soldered or otherwise affixed to a SSD circuit board. The controller102may be in electronic communication with a switch device108that functions as a switch. The switch device108may be located in a circuit formed by the capacitor104and coil106. The capacitor104may be any capacitor or similar energy storage device, e.g a battery. In some embodiments more than one capacitor104may be used. It is preferable that capacitor104be non-flammable and sufficiently large enough to provide the energy needed to destroy the SSD storage110and robust enough to avoid overheating and catching fire in such a way as to injure the user or unnecessarily damage the computer or other device in which the SSD storage110is enclosed. For example, in certain embodiments, capacitor104may be a 1000 μF capacitor. It will be appreciated that various capacitor form factors may be used to accommodate the physical size of the SSD storage110or any associated housing. In some embodiments, the capacitance value of a capacitor104may range from a small value such as 10 μF up to, and exceeding, 9800 μF. In certain embodiments, the capacitor104may be charged by a charging circuit111. Charging circuit111may be configured to provide an electric charge to the capacitor104. Once charged, the SSD destruction system100is ready for use. In some exemplary embodiments, a rechargeable battery may be used instead of or in combination with one or more capacitors. It will be appreciated that the capacitor104may be sized and additional protection components employed (for example, thermally operated circuit interruption devices) such that once destroyed, SSD components will not overheat and cause damage to the computer or other device in which the SSD storage110is enclosed.

During normal operation, the switch device108functions like an open switch and does not conduct current from the capacitor104to the coil106. However, when the controller102determines that a condition has occurred which necessitates the destruction or erasure of the SSD data, the controller102causes the switch device108to allow the capacitor104to rapidly discharge into the coil106. This discharge may also be referred to herein as an energy pulse. The discharge or pulse allows for a rapid localized heating at the SSD storage110which prevents damage to components not related to the SSD storage110. Depending upon the configuration of the SSD storage110, the coil106can inductively or resistively heat the SSD storage110to the point that it becomes amorphous. In certain embodiments, heat from the coil106may cause the SSD storage110to fracture or crack, similarly rendering the SSD storage110permanently inoperable and the data stored thereon unrecoverable. Transition to the amorphous state destroys any data stored by the SSD storage110. One of ordinary skill in the art will appreciate that the sizing of coil106and capacitor104is dependent upon the configuration of the SSD storage device110. In some exemplary embodiments, a capacitor in the range of 470 μF is used. However, larger or smaller sizes may be used depending upon the circuitry of the SSD storage device110. It will be appreciated that the coil106is proximate to the SSD storage device110, and in some embodiments, may be in direct contact with the SSD storage device110.

In some embodiments, a device, including, for example, a controller102may be configured to monitor the charge level of the capacitor104and verify that the charge on the capacitor104is sufficient to reliably destroy the SSD storage110. If the level of charge detected is too low, the controller102may cause the charging circuit111to provide a charge level to the capacitor104that is sufficient to destroy the SSD storage110before the switch device108is instructed to close.

In certain exemplary embodiments, it may be desirable to also disable or destroy the SSD control circuitry112associated with the SSD storage110. SSD control circuitry112may comprise additional electronic components related to the operation of the SSD. Destroying these components would further limit any use of the SSD. In such an embodiment, a second capacitor114may be charged by a second charging circuit116. The second capacitor114may be connected to the SSD control circuitry112such that when a voltage control device118, for example a switch, is caused to close or activate by the controller102, the energy stored in the second capacitor114discharges into the control circuitry112and destroys and/or renders inoperable the control functions of control circuitry112. In certain embodiments, the control circuitry is destroyed via a voltage overload at the control circuitry112. In some embodiments, the voltage control device118is a second switch, that when closed, allows for the discharge of energy from the second capacitor114to the SSD control circuitry112or an induction coil proximate to the SSD control circuitry112. Certain exemplary embodiments may combine certain portions of these components. For example, an exemplary embodiment may use a single capacitor and charging circuit for both the SSD and control circuit destruction. In some embodiments, SSD control circuitry112may comprise the controller102. In such embodiments, destruction of the SSD storage110and SSD control circuitry112must be accomplished sequentially, with the SSD storage110destroyed first and the SSD control circuitry112destroyed second. This is because, in such an embodiment, the destruction of SSD storage110is dependent on proper operation of the controller102and SSD control circuitry112.

In certain embodiments, a voltage higher than would normally be supplied to semiconductor devices, e.g. those which control read/write access to a SSD, may be discharged from a capacitor or other energy storage device into the semiconductor devices. Thermal protection devices may be employed in such embodiments to limit the electrical current provided to the semiconductor devices after the higher than normal voltage is discharged in order to prevent damage to the device in which the SSD is deployed. The capacitor is selected such that it can supply a voltage with sufficient current available (an energy pulse) to cause the semiconductors to be damaged or destroyed. Other devices that may store the energy for the pulse include batteries (including rechargeable), supercapacitors, etc.

In some embodiments, SSD destruction system100may be configured to destroy a plurality of SSD devices using a large induction coil106operable to reach a high enough temperature to destroy the plurality of SSD devices at once. For example, a plurality of SSD devices may be positioned proximate to the large induction coil and sufficient heat applied for a predetermined duration, e.g. 200° Fahrenheit for 5 seconds, capable to destroy the data on the SSD devices.

FIG. 2illustrates an exemplary circuit board200with a plurality of integrated circuits (e.g. NAND chips)202that together comprise a SSD storage110. A connector204may be configured such that the circuit board200can be connected to a larger circuit board, e.g. a motherboard (not shown) which comprises SSD control circuitry112. In certain embodiments, SSD control circuitry112may be located on the circuit board200. As illustrated, a coil106is located at each integrated circuit202. It will be appreciated that the plurality of coils106may be connected such that energy may flow from the capacitor104through each coil106and generate a substantially similar heating pattern at each coil106. A capacitor104is connected to the coils106through the switch device108. To initiate the destruction of the SSD storage110, the controller102may provide a signal to the switch device108. As is shown, the coils106are located such that they are proximate to the integrated circuit202in order to provide the inductive heating required to cause the integrated circuit202substrate to become amorphous or cause the chip embodying the integrated circuit202to fracture or crack. In other exemplary embodiments, the coils106could be located under the integrated circuit202or could be formed integrally with the chips in order to position the inductive coil106more closely to the substrate.

In some exemplary embodiments, the storage component of the SSD is paired with a particular drive controller. Any attempt to access the drive from another controller would result in the destruction of the protected SSD. An illustration of such an embodiment is illustrated inFIG. 3. As shown, a SSD storage110is in communication with a SSD control circuitry112. Both the SSD storage110and the SSD control circuitry112are connected to the SSD destruction system302which has access to the communication bus304between the SSD control circuitry112and a drive controller306. In an exemplary embodiment, the drive controller306and SSD drive assembly308are both serialized with unique identifiers. Software instructions are executed by the controller (not shown) of the SSD destruction system302which stores an association between the SSD drive assembly308and drive controller306. If the drive assembly308is connected to a drive controller306with a different identifier, the controller102identifies that the drive controller306is not correct and causes the SSD destruction system302to destroy the contents of the SSD drive assembly308. In this manner, attempts to access data on a SSD drive assembly308by an unauthorized controller306is prevented.

In certain operating environments, there are circumstances in which it may be desirable to change the security configuration of a SSD drive assembly308. In some embodiments, encrypted keys, e.g. issuer-subscriber keys, blockchain keys, etc., may be used to enable later changes to the configuration of the controller which regulates the destruction of the SSD storage110. These keys may be generated during the setup and configuration of a SSD drive assembly308and can be registered with a centralized command-and-control storage vault. As was noted above, in certain embodiments, the SSD drive assembly308may be paired to a specific drive controller306. Should an authorized user wish to change this pairing, that user may be provided with the key from the centralized command-and-control vault. This encrypted key is provided to the SSD drive assembly308which decrypts the key and applies it to the SSD destruction system302to enable a new pairing to take place. This allows for SSD drive assembly308to be connected to a different drive controller306when such a connection is authorized.

FIG. 4shows a block diagram400illustrating various initiation mechanisms related to the SSD destruction systems and methods as disclosed herein. An exemplary SSD destruction device402may be configured to destroy the SSD storage404and/or the SSD control circuitry406, consistent with methods and systems as taught by the present disclosure. In certain embodiments, the SSD destruction device402, the SSD storage404, and the SSD control circuitry406may be associated with an SSD assembly having a SSD housing408. In some embodiments, the housing408is configured to automatically detect intrusion or modification attempts via an enclosure intrusion detection module410. The intrusion detection module410may comprise a series of sensors configured to recognize when the housing408is being opened or accessed, and send an initiation signal to the SSD destruction device402to destroy the SSD storage404and/or the SSD control circuitry406. Triggering automatic destruction of these components based on a detected intrusion of the housing408can prevent unauthorized modification or disablement of the SSD destruction device402.

The destruction of the SSD storage404and/or the SSD control circuitry406can also be initiated on demand, e.g. via a local user input command412. A user may issue a command to destroy the SSD storage404and/or the SSD control circuitry406from a keyboard or other input method. This can be performed using a combination of keys, similar to the “Ctrl-Alt-Delete” combination that is familiar to many computer users. As one of ordinary skill in the art will recognize, such a combination must be one that cannot easily be accidentally performed as the result is not only permanently lost data, but also the likely destruction the SSD storage404and/or the SSD control circuitry406, resulting in an expensive replacement. Because of the permanence of the result, certain exemplary embodiments may require not only a keyboard input, but the entry of a password or code before the contents of the SSD storage404and/or the SSD control circuitry406will be destroyed.

In other embodiments, the initiation of the destruction of the SSD storage404and/or the SSD control circuitry406can be accomplished externally to the computer device associated with the SSD. As shown inFIG. 4, a centralized command-and-control host414can automatically initiate the destruction of the SSD storage404and/or the SSD control circuitry406. The command-and-control host414may be configured to automatically issue a destruction command based on a trigger event, e.g. a security breach. In this scenario, certain SSDs, such as those containing extremely sensitive or confidential data, may be destroyed remotely and on-demand. As with the keyboard input embodiment disclosed previously, such an embodiment should be secure from accidental initiation and from access by those with nefarious intent. As such, a secure communications protocol, for example, requiring the use of an encrypted key, is employed to communicate the command from a central command-and-control structure.

While the present disclosure and related concepts have been illustrated by the description of various embodiments thereof, and while these embodiments have been described in considerable detail, it is not the intention of the Applicant to restrict or in any way limit the scope of the appended claims to such detail. Additional advantages and modifications will readily appear to those skilled in the art. Moreover, in some instances, elements described with one embodiment may be readily adapted for use with other embodiments. Therefore, the disclosure, in its broader aspects, is not limited to the specific details, the representative apparatus, and illustrative examples shown and described. Accordingly, departures may be made from such details without departing from the spirit or scope of the general disclosed concepts.