US20010025343A1

US20010025343A1 - Random bit mask generation for obscuring data on nonvolatile memory device

Info

Publication number: US20010025343A1
Application number: US09/795,407
Authority: US
Inventors: Roy Chrisop; Jack Van Oosterhout
Original assignee: Sharp Laboratories of America Inc
Current assignee: Sharp Laboratories of America Inc
Priority date: 2000-03-27
Filing date: 2001-02-28
Publication date: 2001-09-27
Also published as: US20060015756A1; US8010807B2

Abstract

A method and apparatus for preventing unauthorized access to information temporarily stored in memory, such as a hard disk drive, associated with a digital document processor, such as a digital copier, printer, or facsimile machine. This invention includes storing information to memory, conducting an operation on the information, and automatically overwriting the information one or more times with a bit mask. Bit masks may be non-random or random sequences of binary values.

Description

BACKGROUND OF THE INVENTION

The present invention relates generally to a method and apparatus for safeguarding data stored in memory and specifically to a method to prevent unauthorized access to data stored temporarily in a nonvolatile memory, such as a hard disk drive.

Digital copiers, laser printers, facsimile machines, document scanners, computers, cellular telephones, digital cameras, and multifunction devices possess several properties in common. All these devices are capable of processing a digital image of a document (“image,” “data,” “image data,” or “image data file”). If the device is able to “read” a document, it typically includes a scanner component, and if the device is able to print a document, it typically includes a printer component. Additionally, these devices typically incorporate a memory. These devices may be collectively referred to as “digital document processors.”

Digital document processors may perform one or more of the following operations: scanning, storing, transmitting, reading, viewing, printing, and deleting. Depending on the particular digital document processor, additional operations may also be performed.

A digital document processor may be able to perform the operation of scanning an original document. The document is illuminated and a charge coupled device or a contact image sensor converts the reflected image into a plurality of electrical signals that together create a digital image of the original document. All or part of the scanned image data is typically stored in a memory.

A digital document processor may be able to perform the operation of printing image data stored in a memory. One type of printing, laser printing, may be accomplished by reading image data from memory in another digital document processor (such as a computer) and using the data to turn a laser beam on and off as the beam scans a charged drum. Where the laser beam strikes the drum, charges are neutralized. Areas not exposed to the beam attract toner powder which is transferred to paper passing over the drum. Pressure applied to the paper as it passes over the drum fuses the toner powder to the paper. The image data stored in memory is thus converted to a physical representation on paper. The image data may also be read from the digital document processor's memory. For example, to accommodate the slower speed of a printer without idling a computer's faster input/output bus, image data in computer memory may be buffered in a printer memory. In addition, confidential or secure image data may be stored in a digital document processor's memory and not printed until an authorized user enters a personal identification number. In this way, a user may send a confidential document to a printer and the document will not print until the user is present.

A digital document processor may be able to perform the operation of copying an original document. By storing image data to memory, multiple copies can be made without repeatedly inputting an original document. In addition, storing image data to memory permits image size, orientation, and page sequence to be modified prior to printing. For example, two original 8½″ by 11″ images stored in memory may be rotated 90 degrees, reduced in size, and printed side-by-side on one side of a single 8½″ by 11″ sheet of paper. As a further example, a large number of original images may be reduced, reoriented, and printed side-by-side on the front and back sides of sheets of paper in a sequence different from the copy sequence in book format.

As exemplified by the scanning, printing, and copying operations, most operations use memory at one or more steps. A transmitting operation, for example, stores image data in a facsimile memory so that an image can be transmitted later or so that images can be simultaneously transmitted and received. In addition, memory is used in digital document processors for other purposes readily apparent to one skilled in the art.

A document may be represented in memory as a bit-mapped image. A bit map is a representation of an original document that consists of rows and columns of dots. The value of each dot may be stored in memory as a single bit to represent a black or white value, or as a byte or several bytes for shades of gray or for colors. Documents may be stored using other storage schemes, but they are all based on a binary code that uses ones (“positives”) or zeros (“negatives”). Throughout this document, storage schemes may be discussed in terms of bit mapping, but one skilled in the art could apply the same principles to other storage schemes.

Memory may include both volatile memory and nonvolatile memory. “Nonvolatile memory” means any memory having the property of retaining stored data when electrical power fails or is turned off. Examples of nonvolatile memory include hard disks, floppy disks, optical disks, compact disks (“CDs”), digital versatile disks (“DVDs”), tape drives, and various integrated circuit (“IC”) memories, as further defined below.

Nonvolatile memory devices, such as floppy disks, hard disks, magnetic tape, optical disks, CDs, and DVDs, are made from media that can be permanently altered to store a bit of information. In the case of floppy disks, hard disks, and magnetic tape, data is stored by writing a pattern of magnetic fields on a magnetic material. Data is read by sensing the presence of a magnetic field and its direction. In the case of optical disks, CDs, and DVDs, a laser is used to form and read bumps on a plastic media.

IC devices such as erasable programmable read-only memory (“EPROM”), electrically erasable programmable read-only memory (“EEPROM”), flash erasable programmable read-only memory, nonvolatile random access memory (“NVRAM”), and flash memory chips represent another type of nonvolatile memory. In these devices, data is represented by electric charges stored on insulated gates. Another type of IC nonvolatile memory is a static random access memory with a battery backup.

With disk type nonvolatile memory, a portion of each disk may store a directory for the disk. To locate a particular data file, the directory is used to identify the location where the data is stored. The directory is also used to identify “free” locations where new data may be stored. In addition, before a disk can be used it may require formatting to define locations where data may be stored. When a user issues a command to format a disk containing previously stored data, only the directory is updated to indicate locations where data may be stored. Similarly, when a user issues a command to delete a file stored on a disk, only the directory is updated. Alternatively, data on a disk may be stored and retrieved using a linked list data structure instead of a table. When a user issues a delete command, only a pointer to the data is updated. In all three situations, however, data remains on the disk until it is later overwritten.

Even when image data is overwritten with new information, a substantial portion or residual elements of the overwritten information may remain on the disk. First, modern disks commonly use data compression and multibit coding techniques. With these techniques, overwriting all zeros, for example, results in writing a single zero and a follow-on code indicating the length of the run. These techniques may result in substantial portions of the original information remaining on the disk. Second, the pattern of magnetization on a disk is modified when image data is stored. Traces of the modified pattern of magnetization remain even after it is overwritten. Sophisticated techniques have been developed that sense subtle changes in magnetization and enable the overwritten information to be recovered from residual elements.

A disadvantage of nonvolatile memory or storage devices is that the stored data may be viewed by unauthorized persons. Because nonvolatile memory retains stored data when electrical power fails or is turned off, it is possible to remove a nonvolatile memory device from a digital document processor, install the memory in a computing system, and use the computing system to read data stored in the nonvolatile memory. A further disadvantage of nonvolatile storage devices is that even when data has been “erased,” it may still be possible to recover and read the information. Data may be recovered and read because only a directory entry or a pointer to the data was erased, because data compression or multibit coding techniques do not overwrite a substantial portion of the data, or because sophisticated techniques may be used to detect residual elements of a magnetic pattern remain on the disk even after an overwrite.

The security risk associated with memory being readable after it is removed from a digital document processor has been recognized, and security solutions for protecting the confidentiality of data stored in memory have been attempted.

Some types of security solutions erase the entire memory. For example, degaussing may be used to neutralize or demagnetize an entire magnetic memory. Physical destruction may be used to prevent access to an entire optical memory. The entire memory of an IC device, such as an EPROM, may be erased by shining an ultraviolet light through a quartz window in the top of the package. In other ICs, such as an EEPROM, the entire memory may be electrically erased by downloading a bit sequence to the device.

Because data is generally recoverable if it is merely “deleted” or “erased” by a software program, the overwriting security solution was developed to obscure or conceal the data. When information is identified as sensitive or a security risk, a specific overwriting instruction is made. Alternatively, data may kept for a predefined period until the memory is needed again and then overwritten.

Overwriting refers to storing new useful data or a meaningless bit pattern at the memory location of the data to be erased. When overwriting is used to conceal information, the overwritten bit pattern may be all ones, all zeros, or any predetermined sequence of binary values. Alternately, the bit pattern may be a random or pseudo-random pattern of binary values (“random bit mask”). A pseudo-random number sequence is so named because an identical sequence of numbers is created each time the generator is invoked, and the sequence eventually repeats. An advantage of overwriting with a random bit mask is that the ability of sophisticated techniques to reconstruct the original data from residual elements is significantly diminished.

Several government agencies have established standards for overwriting data stored on a hard disk drive. Typically, these standards require two or more overwrite operations. The Department of Defense, for example, requires three overwrites: (1) a binary value is written, (2) a complementary binary value is written, and (3) a random value is written.

PowerQuest's DATAGONE™ is a commercially available software program that erases data from a hard disk using overwriting operations. DATAGONE™ erases an entire partition of a hard drive. White Canyon Software's SECURECLEAN™ is another software program that erases data from a hard disk by performing overwrite operations at the file level.

Windmill Software Ltd.'s Windmill Logger is a data acquisition software program that exemplifies the use of an overwriting operation to conserve space on a hard disk drive. To prevent a user's hard disk drive from being filled with data, the user may specify a set of data files that may be reused. For example, seven data files, one for each day of the week, may be specified. When all seven specified files are full, data in the first file is automatically overwritten with new data. On the next day, the second data file is over-written, etc.

U.S. Pat. No. 6,012,145 to Mathers, et al. (“the Mathers reference”) discloses another means for securing nonvolatile memory. Specifically, the Mathers reference discloses a password security system for protecting information recorded on the portable hard disk drives that are typically used in laptop portable computers. The Mathers reference requires an additional microprocessor, a keyboard, a display, and an operating system. While the Mathers reference provides a security means for portable hard disk drives, the additional hardware and software required make it expensive and impractical for use with hard disk drives incorporated into digital document processors other than portable laptop computers.

Ukai, et al., U.S. Pat. No. 5,642,199, (“the Ukai reference”) discloses a digital copier or a complex copier having a facsimile function with a security function for keeping a record of persons who copied or transmitted images and the dates of copying or transmission. In addition, the type of image may be recorded, or a “thinned” version of the document image may be saved. While the Ukai reference discloses a means for identifying the person who may have had unauthorized access to a document, it does not prevent unauthorized access to a document.

BRIEF SUMMARY OF THE INVENTION

All the known solutions for keeping image data secure are concerned with image data that a user intends to store for a time. Subsequently, a specific request (or a predefined instruction) is made to delete, erase, or overwrite the image data when it is no longer needed.

With the present invention the primary concern is to perform an operation, not to store data. The present invention, therefore, is directed to keeping data secure when data storage is transitory and incidental to an operation, that is, when it is known that the data need only be stored until an operation is complete. There is no intent to store the data. When the operation is complete, the stored image data in memory is no longer needed, but leaving the unneeded image data in memory creates a security risk.

The present invention relates generally to a method for safeguarding data stored in memory and specifically to a method for preventing unauthorized access to data stored temporarily in a nonvolatile memory.

One preferred embodiment of the present invention is a method for concealing information stored in a digital document processor memory, comprising storing information, conducting an operation on the stored information, and automatically overwriting the information with a bit mask.

An alternative preferred embodiment of the present invention safeguards the erased image data against computer access outside the scope of normal operation of a digital document processor by actually erasing the data, not just restricting its access.

An additional preferred embodiment safeguards the erased image data from sophisticated methods that use residual elements that remain on a disk to recover the original data.

The foregoing and other objectives, features, and advantages of the invention will be more readily understood upon consideration of the following detailed description of the invention, taken in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

FIG. 1 is a flow diagram of an exemplary embodiment of the present invention, illustrating operation of a digital copier system whose image data, stored temporarily in a nonvolatile copier memory, is automatically overwritten with a bit mask. [0031]
FIG. 2 is a flow diagram of an exemplary embodiment of the present invention, illustrating operation of a facsimile machine whose image data, stored temporarily in a nonvolatile facsimile memory, is automatically overwritten with a bit mask. [0032]
FIG. 3 is a flow diagram of an exemplary embodiment of the present invention, illustrating operation of a printer whose image data, stored temporarily in a nonvolatile printer memory is automatically overwritten with a bit mask. [0033]
FIGS. 4A, 4B are flow diagrams of an exemplary embodiment of the present invention, illustrating operation of a scanner, a computer system, and a printer whose respective image data, stored temporarily in nonvolatile memories, are automatically overwritten with a bit mask after an operation is completed. [0034]
FIG. 5 is a flow diagram of an exemplary embodiment of the present invention, illustrating a method of deleting a plurality of image data files stored in a plurality of nonvolatile memories by automatically overwriting image data in each file with a bit mask.[0035]

DETAILED DESCRIPTION OF THE INVENTION

FIGS. [0036] 1-5 are exemplary embodiments of the present invention showing a method for safeguarding data stored temporarily in a nonvolatile memory. FIG. 1 shows the invention as applied to a digital copier. FIG. 2 shows the invention as applied to a facsimile machine. FIG. 3 show the invention as applied to a printer. FIGS. 4A and 4B show the invention as applied to a several digital document processors. FIG. 5 shows the invention as applied to a method for safeguarding data stored temporarily in a plurality of memories. These examples, as will be discussed individually, embody the basic principles of the methods or approaches of the present invention for concealing (“obscuring,” “obliterating,” “erasing,” or “deleting”) information stored in at least one memory. Specifically, these examples show storing information to memory, conducting an operation on the information, and automatically overwriting the information by storing a bit mask to the memory.
FIG. 1 shows an exemplary embodiment of the present invention directed to a digital copier system. As shown, an original document is scanned [0037] 100, converted to image data 105, and stored in a copier memory 110. The steps are repeated until all pages of the original document have been scanned and stored in memory 115. The image data is read from memory 120 and used to print an image of each page of the original document 125. After the requested number of copies have been printed 130, the image data stored in the copier memory is automatically overwritten with a bit mask 135. It should be noted that this method may be modified, for example, by automatically overwriting after each page is printed.
FIG. 2 shows an exemplary embodiment of the present invention directed to a facsimile machine. As shown, an original document is scanned [0038] 200, converted to image data 205, and stored in a facsimile memory 210. The image data is used to transmit an image of the original document to a receiver 215. The receiver may be a facsimile machine, a computer system, a printer, or any other digital document processor capable of receiving facsimile transmissions. The receiver may have receiver memory associated with it. After successful transmission to the receiver, the image data stored in the facsimile memory is automatically overwritten with a bit mask 220. These steps are repeated until all pages of the original document have been scanned and transmitted to the receiver 225. In an alternative preferred embodiment, the facsimile memory is automatically overwritten with a bit mask after all pages are scanned and transmitted. It should be noted that the facsimile machine or other digital document processor that receives the image may include an embodiment of the present invention in which the received image is saved to memory and automatically overwritten after it is printed.
FIG. 3 shows an exemplary embodiment of the present invention directed to a printer. As shown, an image is received from a transmitting [0039] device 300 and stored in a printer memory 305. The transmitting device may be a computer system or any other device capable of transmitting image data. The image data is read from the printer memory 310 and used to print an image 315. After the image is successfully printed, the image data stored in the printer memory is automatically overwritten with a bit mask 320. It should be noted that this method may be modified. In a large document, for example, memory may automatically be overwritten as the image data is used to print each page of the image.
FIGS. 4A, 4B show an exemplary embodiment of the present invention as applied to a scanner, computer, and printer. These figures show how the present invention may be used in multiple digital document processors. As shown in FIG. 4A, an original document is scanned [0040] 400, converted to image data 405, and stored in a scanner memory 410. The image data is transmitted to the computer 415 where it is received 420 and stored in a computer memory 425, then the scanner's memory is automatically overwritten with a bit mask 430. The image data is transmitted to the printer 435, and, as shown in FIG. 4B, is received 450 and stored in a printer memory 455. In one preferred embodiment, the stored image data in the computer memory is automatically overwritten with a bit mask 440. In an alternative preferred embodiment, the stored image data in the computer memory is not automatically overwritten with a bit mask. The image data is read from the printer memory 460 and used to print an image 465. After the image is successfully printed, the image data stored in the printer memory is automatically overwritten with a bit mask 470.
FIG. 5 shows an exemplary embodiment of the present invention directed to a method of deleting a plurality of temporary image data files stored in a plurality of nonvolatile memories by automatically overwriting the image data in each file with a bit mask when the operation or operations that created the temporary image data files are complete. Temporary image data files are created by digital document processors for many reasons including Internet downloading, viewing, backing-up, printing, and for other reasons readily apparent to one skilled in the art. These temporary files tend to clutter a system and create a security risk. [0041]
As shown, a digital document processor receives a [0042] document image 500, and stores the image data in a first temporary memory 505. In one preferred embodiment, a computer receives image data via the Internet, and it is stored in a temporary Internet file. A user views the image data on a display or computer screen 515. The viewing operation includes an operation of storing image data 520 in a second temporary memory dedicated to the display. An automatic backup operation is performed 525 wherein image data is stored in a third temporary memory 530. (Automatic backup operations may be performed at short periodic intervals so that if the system loses power before the user requests a save operation, only those changes made by a user to a document since the last automatic save operation will be lost). A user performs a printing operation 535 that includes the operations of storing image data 540 in a fourth temporary memory on the digital document processor and in a printer memory.
As shown in FIG. 5, at the end of a user session (comprising several operations) [0043] 545, a search is performed to find an image data file stored in a temporary memory 550. When the image data is found, the image is overwritten with a bit mask 555. The steps of finding image data and overwriting the image with a bit map are repeated until all images stored in memory are found and overwritten 560. In an alternative preferred embodiment, the image data stored in a temporary memory is overwritten with a bit mask when each operation that created the image is complete. For example, a viewing operation may result in image data being stored in a first temporary memory. After viewing is concluded, the image data stored in the first memory is automatically overwritten with a bit mask.
The present invention may be adopted for many purposes and may have many variations. For example, the present invention may be adopted for use with any digital document processor including a photocopier, a printer, a document scanner, a facsimile machine, a computer, a personal digital assistant, a cellular telephone, or a digital camera. The operation that triggers the automatic overwrite may be printing, copying, scanning, deleting, storing, modifying, transmitting, reading, writing, viewing, or any other type of operation implemented by a digital document processor. The overwrite function may overwrite memory with a variety of bit masks, for example, a pseudo-randomly generated bit mask, a randomly generated bit mask, a predetermined bit mask, a sequence of binary ones, a sequence of binary zeros, a predetermined sequence of binary numbers, information bits with a positive polarity, or information bits with a negative polarity. In addition, the overwrite function may consist of overwriting memory multiple times with one or more different bit masks. The overwriting scheme selected may be optimized for specific types of storage technology. For example, overwriting schemes may include: (1) a single write with a random or pseudo-random bit mask; (2) multiple writes with random or pseudo-random bit masks; or (3) multiple writes with a combination of predetermined, predictable bit masks (such as all ones, all zeros, checkerboard, etc.) and unpredictable (such as random and pseudo-random) bit masks. [0044]
In one preferred embodiment, if an operation being conducted is interrupted (for example, by a power failure or a paper jam) the invention will automatically overwrite any stored information on the memory (“automatic interruption overwrite”). It should be noted that automatic interruption overwrite could require an additional backup power source, so that if power were interrupted, there would be enough energy available to automatically overwrite the information. Automatic interruption overwrite would prevent information from being stolen by someone's disrupting power and then pulling the memory. In an alternate preferred embodiment the operation must be completed before the invention automatically overwrites any information on the memory (“completed overwrite”). This embodiment might be chosen if a user were more concerned with losing information by computer error than by theft. It should be noted that devices may allow a user to toggle between or select between the automatic interruption overwrite feature and the completed overwrite feature. Alternately, a programmer may select the automatic interruption overwrite or completed overwrite for select or all operations, so that devices are preprogrammed with the features. [0045]
The terms and expressions that have been employed in the foregoing specification are used as terms of description, not of limitation, and are not intended to exclude equivalents of the features shown and described or portions of them. The scope of the invention is defined and limited only by the claims that follow. [0046]

Claims

What is claimed is:

1. A method for concealing information stored in at least one memory, said method comprising the steps of:

(a) storing information to said at least one memory;

(b) conducting an operation on said information stored in said at least one memory; and

(c) automatically overwriting said information by storing a bit mask to said at least one memory.

2. The method of

claim 1

, wherein said step of storing information further comprises a step selected from the group consisting of:

(a) storing said information to a photocopier memory;

(b) storing said information to a printer memory;

(c) storing said information to a document scanner memory;

(d) storing said information to a facsimile machine memory;

(e) storing said information to a computer memory;

(f) storing said information to a personal digital assistant memory;

(g) storing said information to a cellular telephone memory; and

(h) storing said information to a digital camera memory.

3. The method according to

claim 1

, wherein said step of storing information further comprises a step of storing information to a nonvolatile memory.

4. The method according to

claim 1

, wherein said step of storing information further comprises a step of storing information to a plurality of memories.

5. The method of

claim 1

, wherein said step of conducting an operation further comprises a step selected from the group consisting of:

(a) printing said information;

(b) copying said information;

(c) scanning said information;

(d) deleting said information;

(e) storing said information;

(f) modifying said information;

(g) transmitting said information;

(h) reading said information;

(i) writing said information; and

(j) viewing said information.

6. The method of

claim 1

, wherein said step of automatically overwriting information further comprises a step selected from the group consisting of:

(a) automatically overwriting said information with a pseudo-randomly generated bit mask;

(b) automatically overwriting said information with a randomly generated bit mask;

(c) automatically overwriting said information with a predetermined bit mask;

(d) automatically overwriting said information with a sequence of binary ones;

(e) automatically overwriting said information with a sequence of binary zeros;

(f) automatically overwriting said information with a predetermined sequence of binary numbers;

(g) automatically overwriting said information at least twice;

(h) automatically overwriting said information to a plurality of memories;

(i) automatically overwriting said information with a positive polarity;

(j) automatically overwriting said information with a negative polarity; and

(k) automatically overwriting said information with a combination of overwriting schemes.

7. An apparatus for concealing information stored in at least one memory, comprising:

(a) said at least one memory for storing information; and

(b) a processor for conducting at least one operation on said information;

(c) means for concealing information automatically after said at least one operation.

8. The apparatus of

claim 7

, wherein said at least one memory is selected from the group consisting of:

(a) a photocopier memory;

(b) a printer memory;

(c) a document scanner memory;

(d) a facsimile machine memory;

(e) a computer memory;

(f) a personal digital assistant memory;

(g) a cellular telephone memory; and

(h) a digital camera memory.

9. The apparatus of

claim 7

, wherein said at least one operation is selected from the group consisting of:

(a) printing said information;

(b) copying said information;

(c) scanning said information;

(d) deleting said information;

(e) storing said information;

(f) modifying said information;

(g) transmitting said information;

(h) reading said information;

(i) writing said information;

(j) overwriting said information; and

(k) viewing said information.

10. The apparatus of

claim 7

, wherein said means for concealing information is selected from the group consisting of

(c) automatically overwriting said information with a predetermined bit mask;

(d) automatically overwriting said information with a sequence of binary ones;

(e) automatically overwriting said information with a sequence of binary zeros;

(g) automatically overwriting said information at least twice;

(h) automatically overwriting said information to a plurality of memories;

(i) automatically overwriting said information with a positive polarity;

(j) automatically overwriting said information with a negative polarity; and

11. The apparatus of

claim 7

further comprising a plurality of memories.