CN107037988B - A method and system for securely deleting flash memory based on file-level granularity - Google Patents

Abstract

The invention discloses a method for safely deleting flash memory based on file-level granularity, which belongs to the field of computer storage. The method of the present invention assigns a globally unique identifier GUID to each file, encapsulates the GUID into each write request and delete request of the file, and constructs a GUID-page adjacency table at the same time for recording invalid physical pages corresponding to each file in real time , when the user deletes a file, the device can find all invalid physical pages and all valid physical pages corresponding to the file through the delete command, and then use the physical page overwriting technology to overwrite all the physical pages of the file to achieve safe file deletion Purpose. The invention also realizes a flash memory safe deletion system based on file level granularity. The technical scheme of the invention solves the problem that the existing flash media-based solid-state disk cannot safely delete a single file efficiently, and on the basis of realizing the safe deletion of a single file in the solid-state disk, it reduces the impact of safe deletion on read and write performance.

Description

A method and system for securely deleting flash memory based on file-level granularity

technical field

The invention belongs to the field of computer storage, and more specifically relates to a method and system for securely deleting flash memory based on file-level granularity.

Background technique

With the development of data recovery technology, it is difficult for the current computer system to completely delete files. By recovering and processing the remaining data on the storage medium, attackers can steal the deleted confidential information, which has become an important hidden danger to the information security of the storage system. A survey report in 2016 found that from more than 200 second-hand hard drives (93% were mechanical hard drives, and the rest were SSDs), it was found that more than 78% of second-hand hard drives had residual data, and 67% of them could recover personal secrets information, 11% of hard drives contain sensitive corporate data. In addition, the survey shows that 36% of the hard disks contain residual data, that is, there are still data remaining after the user has deleted the operation; 40% of the hard disks have been formatted, but there are still data remaining in the hard disk; Secure Erase means to erase data. This fully shows that common delete and format operations cannot really delete data, and users need to take safe delete measures to prevent data leakage.

Safe deletion refers to the use of various technical means to make the data in the storage carrier unrecoverable after being deleted, and the device can be used again. At present, a variety of secure deletion methods based on overwriting have been proposed for magnetic media. The main idea is that when deleting a file, the LBA (Logical Block Address) space corresponding to the file is rewritten, and the physical medium that stores the original data of the file is overwritten. , to securely delete the file. However, due to the characteristics of flash memory updating in different places, when the LBA space corresponding to the file is rewritten, the physical page containing the original data of the file will become invalid, and the overwritten data will be written to a new physical page, and the overwritten file cannot be achieved. Effects on raw data. At the same time, after a lot of reading and writing, there may be several copies of each data page of the file. The storage time of these data page copies in the storage medium is unpredictable, and only part of them can be recovered during garbage collection, occupying While using up space on the SSD, it leaks information from deleted files. Therefore, for flash-based solid-state disks, it is necessary to introduce a new secure deletion technology to change this dilemma.

The granularity of existing secure deletion methods roughly includes four categories: page-level secure deletion, block-level secure deletion, file-level secure deletion, and full-disk secure deletion. The page-level secure deletion method uses a single physical page as a unit to securely delete invalid pages caused by write updates in real time. In the process of file editing and modification, write update operations are very frequent, and the page-level secure delete method will seriously affect the solid state. The response of the disk to normal read and write requests; the block-level secure deletion method takes the physical block as the unit, and uses the block erasure method to securely delete the physical block. When there are valid pages in the block, the need to migrate valid pages will bring overhead, and The block granularity is poor in practicability; while the file-level secure deletion takes the file as the unit, usually the file deletion operation is infrequent, and only when the user deletes a file, the secure deletion operation will be triggered, which has little impact on the read and write performance of the SSD; The scope of secure deletion of the entire disk is narrow. For common application scenarios where multiple users share storage resources, it is impossible to securely delete the entire physical disk. Even the secure deletion of the entire virtual disk means the safe deletion of a file.

For flash-based solid-state disks, although files cannot be safely deleted by overwriting the LBA space of the files, the physical media can be directly overwritten. For SLC flash memory, some people have proved through experiments that it is feasible to write the physical page of the SLC flash memory twice, that is, the physical page storing sensitive data can be overwritten by the ordinary physical page write command, so as to realize the SLC Secure deletion of flash memory. However, the extra physical page overwriting operation will affect the response of the flash memory to normal read and write requests, and the real-time safe deletion of invalid pages will seriously affect the performance of the solid state disk; and the secure deletion method of the file granularity proposed by it needs to traverse all the The physical page is used to determine the invalid page copy corresponding to the file, and the delay is very large.

As shown in Figure 1: For MLC flash memory, it supports 4 voltage levels, and each cell can store 2 bits. The state change strictly follows the rule of threshold voltage rise, and the state cannot be reversed before erasing. Input operations must be performed in a certain order;

When securely removing an MLC flash-based SSD, there are two limitations:

(1) Affected by programming crosstalk, when both the low page and the high page of the MLC flash memory are valid, the low page or the high page cannot be overwritten separately, otherwise the data in the high page or the low page will be destroyed;

(2) The error rate of each physical block of MLC flash memory increases as the number of overwritten physical pages increases, that is, each physical block can only withstand part of the physical pages being overwritten.

Due to these limitations, there are two traditional solutions: one is to use MLC flash memory as SLC flash memory, first use only the low page in the paired page (Paired Page), only when the low page is invalid and overwritten, The high page corresponding to the low page can be used, which seriously wastes the capacity of the MLC flash memory; the other is that when a page in the paired pages of the MLC flash memory needs to be overwritten, the other page in the paired page must first be overwritten. Migrating the data in the memory, and then overwriting the paired pages, while wasting the capacity of the MLC flash memory, the security deletion efficiency is low; therefore, the simple physical page overwriting method is not suitable for the MLC flash memory.

Contents of the invention

Aiming at the above defects or improvement needs of the prior art, the present invention provides a method and system for securely deleting flash memory based on file-level granularity, the purpose of which is to transfer files to the bottom layer by assigning a GUID number to each file information, so that the device can grasp the storage location of the file data block and record the invalid physical pages generated by each file in real time; when the user deletes a file, the device can find all invalid physical pages and all valid physical pages corresponding to the file through the delete command , and then use the physical page overwriting method to overwrite all the physical pages of the file to achieve the purpose of securely deleting the file, thereby solving the technical problems of low efficiency and large delay in the existing flash memory secure deletion technology.

In order to achieve the above object, according to one aspect of the present invention, a method for securely deleting flash memory based on file-level granularity is provided, the method comprising:

(1) GUID allocation and encapsulation: assign a globally unique identifier GUID for each file, and encapsulate the GUID of the file into the write and delete request of the file; if it is a write request, then enter step (2); if it is a delete request, then Go to step (5);

(2) Write medium judgment: if the storage medium is MLC flash memory, then enter step (3); otherwise enter step (4);

(3) Allocate paired pages of MLC flash memory: find the last physical page location of the file according to the GUID number of the write request, if it is a low page, allocate the high page corresponding to the low page to the write request, so that the data block of the file Distributed in MLC pairs of physical pages; if it is a high page, allocate a free low page to the write request; if there is no free low page, start garbage collection and allocate a free low page to the write request;

(4) Invalid page of record file: use GUID-page table to record the invalid physical page produced by each file in real time;

(5) Deletion medium judgment: if the storage medium is MLC flash memory, then enter step (6); if the storage medium is SLC flash memory, then enter step (7);

(6) Safe deletion based on MLC flash memory: Find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request. If the number of overwrites of the physical block where the physical page is located does not exceed the upper limit, the overwrite technology is used for safe deletion. After the valid pages in the migrating physical block whose write times exceed the upper limit, the physical block is erased to achieve safe deletion;

(7) Safe deletion based on SLC flash memory: find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request, and then use the physical page overwriting technology to safely delete the data in these physical pages;

(8) Secure deletion of metadata: According to the metadata modification request generated by the file deletion operation and the modification of the mapping relationship, the physical page where the metadata is located is found, and the physical page where the metadata is located is safely deleted.

Further, the step (3) specifically includes:

(31) Physical page query: search the GUID-page table according to the GUID of the write request, and find the physical page number of the page node pointed to by the head node pointer in the corresponding GUID-page table;

(32) Judging the page: judging whether the physical page number is a low page, a high page or the initial value of the physical page number, if it is a low page, allocate the high page corresponding to the low page to the write request, and enter step (35); if High page or initial value of physical page number, then judge whether there is free low page in the solid-state disk, if yes, then allocate free low page to write request, enter step (34); Otherwise enter step (33);

(33) Garbage collection: first migrate the valid pages in the target block to be recycled, and at the same time look up the physical page number of the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID corresponding to the valid page, if the page node If the physical page number of the valid page is the same as the physical page number of the valid page, change the physical page number of the page node to the physical page number after the valid page migration; otherwise, do not process; then find the corresponding page according to the GUID corresponding to the invalid page in the target block GUID-page table, delete the page node whose physical page number is equal to the physical page number of the invalid page in the GUID-page table; erase the target block, and then allocate the free low page to the write request;

(34) Update the physical page number: update the physical page number of the page node pointed to by the head node pointer in the GUID-page table of the write request to the physical page number of the newly allocated physical page.

Further, the step (4) specifically includes:

(41) Write hit judgment: look up the address mapping table according to the logical address of the write request, if hit, then enter step (42); otherwise enter step (43);

(42) Record invalid physical page: invalidate the state of the old physical page, allocate a new page node of the GUID-page table, the physical page number of the page node is the old physical page number, and the new page node link At the end of the GUID-page table corresponding to the GUID of the write request;

(43) Updating the address mapping table: updating the address mapping table.

Further, the step (6) specifically includes:

(61) Find invalid physical pages: According to the GUID of the deletion request, search for the page node pointed to by the head node pointer in the corresponding GUID-page table, and all page nodes linked after the page node are invalid physical page nodes ;

(62) Reset the GUID-page table: delete all page nodes in the corresponding GUID-page table according to the GUID of the deletion request, and reinitialize the head node;

(63) Search for valid physical pages: resolve the logical address and size of the deletion request into multiple logical page numbers, search the address mapping table according to the logical page numbers, find the corresponding valid physical page numbers, and set the status of the found valid physical pages is invalid;

(64) Overwrite times judgment: for all found physical pages, judge whether the overwrite count of the physical block where the physical page is located exceeds the upper limit of the overwrite times of the physical block; if not, then enter step (65); otherwise enter step (66);

(65) Overwrite deletion: use the physical page overwrite technology to safely delete the data in the physical page; the overwrite count of the physical block where the physical page is located is increased by 1;

(66) Physical block erasure: Migrate all valid physical pages in the physical block where the physical page is located, update the corresponding address mapping table and GUID-page table at the same time, and then erase the physical block to realize safe deletion.

Further, the step (7) specifically includes:

(71) Safely delete invalid physical pages: According to the GUID of the deletion request, search for the page node pointed to by the head node pointer in the corresponding GUID-page table, and all page nodes linked after the page node are invalid physical page nodes point, use the physical page overwrite technology to safely delete the data in the invalid physical page;

(72) Delete page node: delete all page nodes in the corresponding GUID-page table according to the GUID of the deletion request, and reinitialize the head node;

(73) Safely delete valid physical pages: resolve the logical address and size of the deletion request into multiple logical page numbers, search the address mapping table according to the logical page numbers, find the corresponding valid physical page numbers, and use physical page overwriting technology for security Delete data in valid physical pages;

(74) Updating the address mapping table: setting the found valid physical page as an invalid physical page, and updating the address mapping table.

According to another aspect of the present invention, a kind of file-level granularity-based flash memory safe deletion system is provided, and the system includes:

The GUID allocation and encapsulation module is used to assign a globally unique identifier GUID for each file, and encapsulate the GUID of the file into the write and delete request of the file; if it is a write request, it will enter the write medium judgment module; if it is a delete request Then enter the delete media judging module;

Write medium judging module, be used for judging if storage medium is MLC flash memory, then enter MLC flash memory paired page allocation module; Otherwise enter file invalid page recording module;

The MLC flash memory paired page allocation module is used to find the last written physical page position of the file according to the GUID number of the write request. If it is a low page, allocate the high page corresponding to the low page to the write request, so that the data block Distributed in MLC pairs of physical pages; if it is a high page, allocate a free low page to the write request; if there is no free space, start garbage collection and allocate a free low page to the write request;

The file invalid page recording module is used to use the GUID-page table to record the invalid physical pages generated by each file in real time;

Delete medium judging module, be used for judging if storage medium is MLC flash memory, then enter the safe deletion module based on MLC flash memory; If storage medium is SLC flash memory, then enter the safe deletion module based on SLC flash memory;

The secure deletion module based on MLC flash memory is used to find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request. If the number of overwrites of the physical block where the physical page is located does not exceed the upper limit, the overwrite technology is used for secure deletion. After the valid pages in the migrating physical block whose write times exceed the upper limit, the physical block is erased to achieve safe deletion;

The secure deletion module based on SLC flash memory is used to find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request, and then use the physical page overwriting technology to securely delete the data in these physical pages;

The metadata safe deletion module is used to find the physical page where the metadata is located according to the metadata modification request generated by the file deletion operation and the modification of the mapping relationship, and safely delete the physical page where the metadata is located.

Further, the paired page allocation module of the MLC flash memory specifically includes:

The physical page query unit is used to search the GUID-page table according to the GUID of the write request, and find the physical page number corresponding to the page node pointed to by the head node pointer in the GUID-page table;

The page judging unit is used to judge whether the physical page number is a low page, a high page or the initial value of the physical page number, if it is a low page, allocate the high page corresponding to the low page to the write request, and enter the update physical page number unit; If it is the high page or the initial value of the physical page number, it is judged whether there is a free low page in the solid-state disk, and if so, the free low page is allocated to the write request, and enters the updating physical page number unit; otherwise, enters the garbage collection unit;

Garbage collection unit: used to first migrate the valid pages in the target block to be recycled, and at the same time look up the physical page number of the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID corresponding to the valid page in the target block. If the physical page number of the node is the same as the physical page number of the valid page, change the physical page number of the page node to the physical page number after the valid page migration; otherwise, do not process; then search according to the GUID corresponding to the invalid page in the target block Corresponding to the GUID-page table, delete the page node whose physical page number is equal to the physical page number of the invalid page in the GUID-page table; erase the target block, and then allocate the free low page to the write request;

The update physical page number unit is used to update the physical page number of the page node pointed to by the head node pointer in the GUID-page table of the write request to the physical page number of the newly allocated physical page.

Further, the file invalid page recording module specifically includes:

The write hit judging unit is used to search the address mapping table according to the logical address of the write request. If it hits, it enters the record invalid physical page unit; otherwise, it enters the update address mapping table unit;

Record the invalid physical page unit, which is used to invalidate the state of the old physical page, allocate a new page node of the GUID-page table, the physical page number of the page node is the old physical page number, and the new page node link At the end of the GUID-page table corresponding to the GUID of the write request;

The update address mapping table unit is used for updating the address mapping table.

Further, the secure deletion module based on MLC flash memory specifically includes:

Find the invalid physical page unit, which is used to find the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID of the deletion request. All page nodes linked after the page node are invalid physical page nodes ;

Reset the GUID-page table unit, which is used to delete all page nodes in the corresponding GUID-page table according to the GUID of the deletion request, and re-initialize the head node;

Find the valid physical page unit, which is used to resolve the logical address and size of the deletion request into multiple logical page numbers, search the address mapping table according to the logical page number, find the corresponding valid physical page number, and set the status of the found valid physical page to is invalid;

The overwrite count judging unit is used for all found physical pages to judge whether the overwrite count of the physical block where the physical page is located exceeds the upper limit of the overwrite count of the physical block; if not, enter the overwrite delete unit; otherwise enter the physical block erase unit;

The overwrite delete unit is used to safely delete data in the physical page by using the physical page overwrite technology; the overwrite count of the physical block where the physical page is located is increased by 1;

The physical block erasing unit is used to migrate all valid physical pages in the physical block where the physical page is located, update the corresponding address mapping table and GUID-page table at the same time, and then erase the physical block to realize safe deletion.

Further, the secure deletion module based on SLC flash memory specifically includes:

Securely delete the invalid physical page unit, which is used to find the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID of the deletion request. All page nodes linked after the page node are invalid physical page nodes point, use the physical page overwrite technology to safely delete the data in the invalid physical page;

The delete page node unit is used to delete all page nodes in the corresponding GUID-page table according to the GUID of the delete request, and reinitialize the head node;

Safely delete valid physical page units, which are used to resolve the logical address and size of the delete request into multiple logical page numbers, search the address mapping table according to the logical page numbers, find the corresponding valid physical page numbers, and use physical page overwriting technology for security Delete data in valid physical pages;

The update address mapping table unit is used to set the found valid physical page as an invalid physical page, and update the address mapping table.

Generally speaking, compared with the prior art, the above technical solution conceived by the present invention has the following technical characteristics and beneficial effects:

(1) Compared with the secure deletion of block-level granularity, the present invention can reduce the impact of secure deletion on the read and write performance of solid-state disks, and does not need to securely delete the invalid pages generated by modification of each file in real time, only when the user deletes the file. perform secure deletion;

(2) Compared with the existing secure deletion method based on MLC, the present invention is more efficient for secure deletion of MLC flash memory, solves the problem of programming crosstalk during secure deletion of MLC, and reduces the physical capacity of MLC on the basis of secure deletion of MLC waste of

Description of drawings

Fig. 1 is a schematic diagram of the writing sequence of the MLC flash memory unit;

Fig. 2 is the implementation flowchart of the inventive method;

Fig. 3 is a schematic structural diagram of the GUID_page table;

Fig. 4 is a flowchart of GUID allocation and encapsulation;

Fig. 5 is the flowchart of allocating paired pages of MLC flash memory;

Fig. 6 is the flowchart of the invalid page of recording file;

Fig. 7 is the flowchart of the secure deletion of SLC flash memory;

Fig. 8 is the flowchart of the secure deletion of MLC flash memory;

Fig. 9 is a flow chart of secure deletion of metadata.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not constitute a conflict with each other.

As shown in Figure 2, the inventive method comprises the following steps:

(1) GUID allocation and encapsulation: assign a globally unique identifier GUID for each file, and encapsulate the GUID of the file into the write and delete request of the file; if it is a write request, then enter step (2); if it is a delete request, then Go to step (5);

(2) Write medium judgment: if the storage medium is MLC flash memory, then enter step (3); otherwise enter step (4);

(3) Allocate paired pages of MLC flash memory: find the last physical page location of the file according to the GUID number of the write request, if it is a low page, allocate the high page corresponding to the low page to the write request, so that the data block of the file Distributed in MLC pairs of physical pages; if it is a high page, allocate a free low page to the write request; if there is no free space, start garbage collection and allocate a free low page to the write request;

(4) Invalid page of record file: use GUID-page table to record the invalid physical page produced by each file in real time;

(5) Deletion medium judgment: if the storage medium is MLC flash memory, then enter step (6); if the storage medium is SLC flash memory, then enter step (7);

(6) Safe deletion based on MLC flash memory: Find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request. If the number of overwrites of the physical block where the physical page is located does not exceed the upper limit, the overwrite technology is used for safe deletion. After the valid pages in the migrating physical block whose write times exceed the upper limit, the physical block is erased to achieve safe deletion;

(7) Safe deletion based on SLC flash memory: find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request, and then use the physical page overwriting technology to safely delete the data in these physical pages;

(8) Secure deletion of metadata: According to the metadata modification request generated by the file deletion operation and the modification of the mapping relationship, the physical page where the metadata is located is found, and the physical page where the metadata is located is safely deleted.

As shown in Figure 3, the GUID-page table structure described in this technical solution is:

The header node of each GUID-page table includes a GUID number and a pointer to the page node, and each page node includes a physical page number and a pointer to the next page node; the GUID-page table of MLC flash memory is in addition to the header The first page node pointed to by the node is a valid page node, and other page nodes are all invalid page nodes; the page nodes in the GUID-page table of the SLC flash memory are all invalid page nodes.

Figure 4 shows the GUID allocation and encapsulation process. Due to the off-site update feature of the solid-state disk, there may be many invalid page copies of the data block of each file in the solid-state disk. The existing file system does not know the invalid page copies of the file. The storage location in the hardware, so this technical solution adds a GUID allocation and encapsulation process at the file system layer, assigns a GUID to each file to uniquely identify each file, and encapsulates the GUID of the file into the write request of the file Or in the delete request, the write request or delete request containing the GUID is passed to the general block layer, then to the driver layer, and then to the device layer, so that the device can grasp the storage location of the file data block through the GUID.

In the existing system, when the file system deletes a file, only the metadata of the file is deleted, and the data blocks of the file are not deleted. To implement secure deletion of a single file, the Trim function needs to be enabled. That is, the deletion request is a Trim command. When the user deletes a file, the operating system will send the Trim command. After the file system receives the Trim command, it will pack the GUID of the file to be deleted into the Trim request, transmit it to the general block layer, and then transmit to the driver layer, and then sent to the device layer to inform the controller which physical pages can be invalidated.

In the embodiment of the technical solution, the operating system, the file system, and the driver layer all support the sending and transmission of the Trim command, and the device layer also supports the processing of the Trim command.

When deleting a certain file, the invalid page copy corresponding to the file can be searched by the GUID of the deletion request, and the valid page corresponding to the file can be found by the data segment of the deletion request; the specific embodiment process is as follows:

(11) record the index node inode number of the file to be written or deleted as the GUID of the file;

(12) Encapsulate the GUID of the file into the write and delete requests of the file.

As shown in Figure 5, it is the process of allocating paired pages of MLC flash memory. Since the MLC flash memory chip has strict requirements on the writing order, it must be written to the lower page of the paired pages first, and then written to the upper page of the paired pages, otherwise data errors will occur. ; and there is programming crosstalk between the paired pages. When overwriting a certain page in the paired pages, it will cause an error in the data of another page in the paired pages. Therefore, it is difficult to implement secure deletion based on MLC flash memory. This technology The scheme adopts a new physical page allocation method, that is, the paired allocation method. The specific process is as follows:

(31) Physical page query: search the GUID-page table according to the GUID of the write request, and find the physical page number of the page node pointed to by the head node pointer in the corresponding GUID-page table;

(32) Judging the page: judging whether the physical page number is a low page, a high page or the initial value of the physical page number, if it is a low page, allocate the high page corresponding to the low page to the write request, and enter step (35); if High page or initial value of physical page number, then judge whether there is free low page in the solid-state disk, if yes, then allocate free low page to write request, enter step (34); Otherwise enter step (33);

(33) Garbage collection: first migrate the valid pages in the target block to be recycled, and at the same time look up the physical page number of the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID corresponding to the valid page, if the page node If the physical page number of the valid page is the same as the physical page number of the valid page, change the physical page number of the page node to the physical page number after the valid page migration; otherwise, do not process; then find the corresponding page according to the GUID corresponding to the invalid page in the target block GUID-page table, delete the page node whose physical page number is equal to the physical page number of the invalid page in the GUID-page table; erase the target block, and then allocate the free low page to the write request;

(34) Update the physical page number: update the physical page number of the page node pointed to by the head node pointer in the GUID-page table of the write request to the physical page number of the newly allocated physical page.

The advantage of this is that when the file is safely deleted, the corresponding high and low pages of the file can be overwritten together, avoiding the data error problem caused by the programming crosstalk between the paired pages when overwriting the MLC.

As shown in Figure 6, the invalid page process of the record file is shown. In order to realize the safe deletion of the flash file level, not only the corresponding valid page of the file in the solid-state disk needs to be safely deleted, but also the copy of the invalid page generated by the modification of the file needs to be safely deleted; Therefore, it is necessary to record the invalid physical page and valid physical page generated by each file in real time; the valid physical page corresponding to the file can be found through the delete command, that is, when the user deletes the file, the data segment of the delete command received by the device layer Parse it into multiple logical page numbers, and obtain the valid physical page number corresponding to the file by looking up the address mapping table; but due to the one-to-one correspondence of the mapping table, the invalid physical page corresponding to the file cannot be found through the logical page number; therefore, a solution is needed To record the invalid physical page corresponding to the file; the specific process is as follows:

(41) Write hit judgment: look up the address mapping table according to the logical address of the write request, if hit, then enter step (42); otherwise enter step (43);

(42) Record invalid physical page: invalidate the state of the old physical page, allocate a new page node of the GUID-page table, the physical page number of the page node is the old physical page number, and the new page node link At the end of the GUID-page table corresponding to the GUID of the write request;

(43) Updating the address mapping table: updating the address mapping table.

Figure 7 shows the safe deletion process of SLC flash memory. At present, all SLC flash memories on the market basically support overwriting (only "1" can be changed to "0"), and the physical page can be deleted before erasing. Overwriting (i.e. the second write operation) does not have a significant impact on the error rate of flash memory; therefore, for SLC flash memory, this technical solution records in real time the invalid physical pages that each file generates during editing and modification, When deleting a file, find all valid physical pages and invalid physical pages corresponding to the file through the GUID and data segment of the delete command, and then use the physical page overwriting method to overwrite these physical pages, thereby realizing file-level secure deletion of SLC flash memory ; The specific process is as follows:

(71) Safely delete invalid physical pages: According to the GUID of the deletion request, search for the page node pointed to by the head node pointer in the corresponding GUID-page table, and all page nodes linked after the page node are invalid physical page nodes point, use the physical page overwrite technology to safely delete the data in the invalid physical page;

(72) Delete page node: delete all page nodes in the corresponding GUID-page table according to the GUID of the deletion request, and reinitialize the head node;

(73) Safely delete valid physical pages: resolve the logical address and size of the deletion request into multiple logical page numbers, search the address mapping table according to the logical page numbers, find the corresponding valid physical page numbers, and use physical page overwriting technology for security Delete data in valid physical pages;

(74) Updating the address mapping table: setting the found valid physical page as an invalid physical page, and updating the address mapping table.

Figure 8 is the process of secure deletion of MLC flash memory. When this technical solution performs secure deletion based on MLC deletion, find all valid physical pages and invalid physical pages corresponding to the file through the GUID and data segment of the delete command, and delete them securely at the same time. The corresponding high page and low page of the file in the MLC flash memory avoid the influence of programming crosstalk; by testing the number of overwritten pages that each block of the MLC flash memory can withstand, set the overwrite threshold, when a block in the MLC flash memory is overwritten When the number of pages exceeds the overwriting threshold, the physical page overwriting method is no longer used for safe deletion, but the valid pages in the block are migrated, and the block is erased to achieve the purpose of safe deletion; the specific process is as follows:

(61) Find invalid physical pages: According to the GUID of the deletion request, search for the page node pointed to by the head node pointer in the corresponding GUID-page table, and all page nodes linked after the page node are invalid physical page nodes ;

(62) Reset the GUID-page table: delete all page nodes in the corresponding GUID-page table according to the GUID of the deletion request, and reinitialize the head node;

(63) Search for valid physical pages: resolve the logical address and size of the deletion request into multiple logical page numbers, search the address mapping table according to the logical page numbers, find the corresponding valid physical page numbers, and set the status of the found valid physical pages is invalid;

(64) Overwrite times judgment: for all found physical pages, judge whether the overwrite count of the physical block where the physical page is located exceeds the upper limit of the overwrite times of the physical block; if not, then enter step (65); otherwise enter step (66);

(65) Overwrite deletion: use the physical page overwrite technology to safely delete the data in the physical page; the overwrite count of the physical block where the physical page is located is increased by 1;

(66) Physical block erasure: Migrate all valid physical pages in the physical block where the physical page is located, update the corresponding address mapping table and GUID-page table at the same time, and then erase the physical block to realize safe deletion.

Figure 9 shows the process of secure deletion of metadata. After the data blocks of the file are safely deleted, the metadata information of the file, such as the name of the file, the inode node, and the mapping information, should still remain in the flash memory, which will leak the file information. . Therefore, it is necessary to further securely delete the metadata related to the file to completely eliminate traces; the specific process is as follows:

(81) Find the physical page where the metadata is located according to the metadata modification request generated by the file deletion operation and the modification of the mapping relationship;

(82) Determine whether the physical page has been safely deleted, and if so, end the deletion; otherwise, perform safe deletion on the physical page where the metadata is located, that is, use the physical page overwriting technology to overwrite the data in these physical pages, and mark the Page has been safely deleted.

Those skilled in the art can easily understand that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention, All should be included within the protection scope of the present invention.

Claims (8)

1. A flash memory security deletion method based on file level granularity, is characterized in that, described method specifically comprises: (1) GUID allocation and encapsulation: assign a globally unique identifier GUID for each file, and encapsulate the GUID of the file into the write and delete request of the file; if it is a write request, then enter step (2); if it is a delete request, then Go to step (5); (2) Write medium judgment: if the storage medium is MLC flash memory, then enter step (3); otherwise enter step (4); (3) Allocate paired pages of MLC flash memory: find the last physical page location of the file according to the GUID number of the write request, if it is a low page, allocate the high page corresponding to the low page to the write request, so that the data block of the file Distributed in MLC pairs of physical pages; if it is a high page, allocate a free low page to the write request; if there is no free low page, start garbage collection and allocate a free low page to the write request; (4) Invalid page of record file: use GUID-page table to record the invalid physical page produced by each file in real time; (5) Deletion medium judgment: if the storage medium is MLC flash memory, then enter step (6); if the storage medium is SLC flash memory, then enter step (7); (6) Safe deletion based on MLC flash memory: Find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request. If the number of overwrites of the physical block where the physical page is located does not exceed the upper limit, the overwrite technology is used for safe deletion. After the valid pages in the migrating physical block whose write times exceed the upper limit, the physical block is erased to achieve safe deletion; Described step (6) specifically comprises: (61) Find invalid physical pages: According to the GUID of the deletion request, search for the page node pointed to by the head node pointer in the corresponding GUID-page table, and all page nodes linked after the page node are invalid physical page nodes ; (62) Reset the GUID-page table: delete all page nodes in the corresponding GUID-page table according to the GUID of the deletion request, and reinitialize the head node; (63) Search for valid physical pages: resolve the logical address and size of the deletion request into multiple logical page numbers, search the address mapping table according to the logical page numbers, find the corresponding valid physical page numbers, and set the status of the found valid physical pages is invalid; (64) Overwrite times judgment: for all found physical pages, judge whether the overwrite count of the physical block where the physical page is located exceeds the upper limit of the overwrite times of the physical block; if not, then enter step (65); otherwise enter step (66); (65) Overwrite deletion: use the physical page overwrite technology to safely delete the data in the physical page; the overwrite count of the physical block where the physical page is located is increased by 1; (66) Physical block erasure: Migrate all valid physical pages in the physical block where the physical page is located, update the corresponding address mapping table and GUID-page table at the same time, and then erase the physical block to realize safe deletion; (7) based on SLC Safe deletion of flash memory: Find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request, and then use the physical page overwriting technology to safely delete the data in these physical pages; (8) Secure deletion of metadata: According to the metadata modification request generated by the file deletion operation and the modification of the mapping relationship, the physical page where the metadata is located is found, and the physical page where the metadata is located is safely deleted. 2. A kind of flash memory safe deletion method based on file-level granularity according to claim 1, is characterized in that, described step (3) specifically comprises: (31) Physical page query: search the GUID-page table according to the GUID of the write request, and find the physical page number of the page node pointed to by the head node pointer in the corresponding GUID-page table; (32) Judging the page: judging whether the physical page number is a low page, a high page or the initial value of the physical page number, if it is a low page, allocate the high page corresponding to the low page to the write request, and enter step (35); if High page or initial value of physical page number, then judge whether there is free low page in the solid-state disk, if yes, then allocate free low page to write request, enter step (34); Otherwise enter step (33); (33) Garbage collection: first migrate the valid pages in the target block to be recycled, and at the same time look up the physical page number of the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID corresponding to the valid page, if the page node If the physical page number of the valid page is the same as the physical page number of the valid page, change the physical page number of the page node to the physical page number after the valid page migration; otherwise, do not process; then find the corresponding page according to the GUID corresponding to the invalid page in the target block GUID-page table, delete the page node whose physical page number is equal to the physical page number of the invalid page in the GUID-page table; erase the target block, and then allocate the free low page to the write request; (34) Update the physical page number: update the physical page number of the page node pointed to by the head node pointer in the GUID-page table of the write request to the physical page number of the newly allocated physical page. 3. A kind of flash memory safe deletion method based on file level granularity according to claim 1, is characterized in that, described step (4) specifically comprises: (41) Write hit judgment: look up the address mapping table according to the logical address of the write request, if hit, then enter step (42); otherwise enter step (43); (42) Record invalid physical page: the state of the old physical page is invalidated, and the page node of the new GUID-page table is allocated, and the physical page number of the page node is the page number of the old physical page, and the new page node Click the link at the end of the GUID-page table corresponding to the GUID of the write request; (43) Updating the address mapping table: updating the address mapping table. 4. A kind of flash memory safe deletion method based on file level granularity according to claim 1, is characterized in that, described step (7) specifically comprises: (71) Safely delete invalid physical pages: According to the GUID of the deletion request, search for the page node pointed to by the head node pointer in the corresponding GUID-page table, and all page nodes linked after the page node are invalid physical page nodes point, use the physical page overwrite technology to safely delete the data in the invalid physical page; (72) Delete page node: delete all page nodes in the corresponding GUID-page table according to the GUID of the deletion request, and reinitialize the head node; (73) Safely delete valid physical pages: resolve the logical address and size of the deletion request into multiple logical page numbers, search the address mapping table according to the logical page numbers, find the corresponding valid physical page numbers, and use physical page overwriting technology for security Delete data in valid physical pages; (74) Updating the address mapping table: setting the found valid physical page as an invalid physical page, and updating the address mapping table. 5. A flash memory security deletion system based on file level granularity, is characterized in that, described system specifically comprises: The GUID allocation and encapsulation module is used to assign a globally unique identifier GUID for each file, and encapsulate the GUID of the file into the write and delete request of the file; if it is a write request, it will enter the write medium judgment module; if it is a delete request Then enter the delete media judging module; Write medium judging module, be used for judging if storage medium is MLC flash memory, then enter MLC flash memory paired page allocation module; Otherwise enter file invalid page recording module; The MLC flash memory paired page allocation module is used to find the last written physical page position of the file according to the GUID number of the write request. If it is a low page, allocate the high page corresponding to the low page to the write request, so that the data block Distributed in MLC pairs of physical pages; if it is a high page, allocate a free low page to the write request; if there is no free space, start garbage collection and allocate a free low page to the write request; The file invalid page recording module is used to use the GUID-page table to record the invalid physical pages generated by each file in real time; Delete medium judging module, be used for judging if storage medium is MLC flash memory, then enter the safe deletion module based on MLC flash memory; If storage medium is SLC flash memory, then enter the safe deletion module based on SLC flash memory; The secure deletion module based on MLC flash memory is used to find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request. If the number of overwrites of the physical block where the physical page is located does not exceed the upper limit, the overwrite technology is used for secure deletion. After the valid pages in the migrating physical block whose write times exceed the upper limit, the physical block is erased to achieve safe deletion; The secure deletion module based on MLC flash memory specifically includes: Find the invalid physical page unit, which is used to find the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID of the deletion request. All page nodes linked after the page node are invalid physical page nodes ; Reset the GUID-page table unit, which is used to delete all page nodes in the corresponding GUID-page table according to the GUID of the deletion request, and re-initialize the head node; Find the valid physical page unit, which is used to resolve the logical address and size of the deletion request into multiple logical page numbers, search the address mapping table according to the logical page number, find the corresponding valid physical page number, and set the status of the found valid physical page to is invalid; The overwrite count judging unit is used for all found physical pages to judge whether the overwrite count of the physical block where the physical page is located exceeds the upper limit of the overwrite count of the physical block; if not, enter the overwrite delete unit; otherwise enter the physical block erase unit; The overwrite delete unit is used to safely delete data in the physical page by using the physical page overwrite technology; the overwrite count of the physical block where the physical page is located is increased by 1; The physical block erase unit is used to migrate all valid physical pages in the physical block where the physical page is located, and update the corresponding address mapping table and GUID-page table at the same time, and then erase the physical block to realize safe deletion; The secure deletion module based on SLC flash memory is used to find all the physical pages corresponding to the file to be deleted according to the GUID-page table and the deletion request, and then use the physical page overwriting technology to securely delete the data in these physical pages; The metadata safe deletion module is used to find the physical page where the metadata is located according to the metadata modification request generated by the file deletion operation and the modification of the mapping relationship, and safely delete the physical page where the metadata is located. 6. a kind of flash memory safe deletion system based on file level granularity according to claim 5, is characterized in that, described MLC flash memory paired page allocation module specifically comprises: The physical page query unit is used to search the GUID-page table according to the GUID of the write request, and find the physical page number corresponding to the page node pointed to by the head node pointer in the GUID-page table; The page judging unit is used to judge whether the physical page number is a low page, a high page or the initial value of the physical page number, if it is a low page, allocate the high page corresponding to the low page to the write request, and enter the update physical page number unit; If it is the high page or the initial value of the physical page number, it is judged whether there is a free low page in the solid-state disk, and if so, the free low page is allocated to the write request, and enters the updating physical page number unit; otherwise, enters the garbage collection unit; Garbage collection unit: used to first migrate the valid pages in the target block to be recycled, and at the same time look up the physical page number of the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID corresponding to the valid page, if the page node If the physical page number of the valid page is the same as the physical page number of the valid page, change the physical page number of the page node to the physical page number after the valid page migration; otherwise, do not process; then find the corresponding page according to the GUID corresponding to the invalid page in the target block GUID-page table, delete the page node whose physical page number is equal to the physical page number of the invalid page in the GUID-page table; erase the target block, and then allocate the free low page to the write request; The update physical page number unit is used to update the physical page number of the page node pointed to by the head node pointer in the GUID-page table of the write request to the physical page number of the newly allocated physical page. 7. A kind of flash memory safe deletion system based on file level granularity according to claim 5, is characterized in that, described file invalid page recording module specifically comprises: The write hit judging unit is used to search the address mapping table according to the logical address of the write request. If it hits, it enters the record invalid physical page unit; otherwise, it enters the update address mapping table unit; Record the invalid physical page unit, which is used to invalidate the state of the old physical page, and allocate the page node of the new GUID-page table. The physical page number of the page node is the page number of the old physical page, and the new page node Click the link at the end of the GUID-page table corresponding to the GUID of the write request; The update address mapping table unit is used for updating the address mapping table. 8. A kind of flash memory safe deletion system based on file level granularity according to claim 5, is characterized in that, described safe deletion module based on SLC flash memory specifically comprises: Securely delete the invalid physical page unit, which is used to find the page node pointed to by the head node pointer in the corresponding GUID-page table according to the GUID of the deletion request. All page nodes linked after the page node are invalid physical page nodes point, use the physical page overwrite technology to safely delete the data in the invalid physical page; The delete page node unit is used to delete all page nodes in the corresponding GUID-page table according to the GUID of the delete request, and reinitialize the head node; Safely delete valid physical page units, which are used to resolve the logical address and size of the delete request into multiple logical page numbers, search the address mapping table according to the logical page numbers, find the corresponding valid physical page numbers, and use physical page overwriting technology for security Delete data in valid physical pages; The update address mapping table unit is used to set the found valid physical page as an invalid physical page, and update the address mapping table.