# US 9,519,433 B2 · Secure virtual sector erasure method and system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,519,433 B2 - Document ID: US9519433B2 - Status: Granted - Kind: B2 - Application number: 14/711,153 - Filed: 2015-05-13 - Published: 2016-11-17 - Granted: 2016-12-13 - Earliest claimed: 2015-05-13 - Assignees: Vsector Security Technologies, LLC - Applicants: VSector Security Technologies, LLC - Inventors: Jeffrey A. Jones; Michael Lawrence Oken; Martin Weber - Web page: https://patentgrep.com/patent/US9519433B2 ## CPC - G06F 3/0619: {in relation to data integrity, e.g. data losses, bit errors} - G06F 3/0608: {Saving storage space on storage systems} - G06F 3/0641: {De-duplication techniques} - G06F 3/0665: {at area level, e.g. provisioning of virtual or logical volumes} - G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/50: Allocation of resources, e.g. of the central processing unit [CPU] - G06F 12/1458: {by checking the subject access rights} - G06F 12/1475: {in a virtual system, e.g. with translation means} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2212/1052: Security improvement - G06F 2221/2143: Clearing memory, e.g. to prevent the data from being stolen - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for sanitizing physical storage in cloud computing and virtual environments. When logical storage is decommissioned in a virtual environment, the underlying physical storage is logically disassociated. However, the underlying physical data blocks remain intact until they are overwritten. Since there is no control over when, or even if, the physical data is ever overwritten, the remaining data is susceptible to compromise. The present disclosure provides a secure erase application that securely erases physical storage associated with to-be deleted resources, such as virtual data stores, virtual images, snapshots and raw virtual disks. ## Claims ### Claim 1 A method comprising: presenting a virtual resource in a user interface; receiving a selection of the virtual resource, the selection indicating that the virtual resource is to be securely erased; isolating the selected virtual resource, wherein the isolating comprises: exclusively locking the selected virtual resource, stopping execution of virtual machine processes associated with the selected virtual resource, and disabling a dynamic redistribution of resources to ensure uninterrupted operation; obtaining access to the selected virtual resource; securely erasing the selected virtual resource by overwriting all virtual sectors of the selected virtual resource; and confirming that all virtual sectors of the selected virtual resource have been overwritten. ### Claim 2 (depends on 1) The method of claim 1, further comprising mapping the overwriting to a physical layer associated with the virtual sectors of the selected virtual resource. ### Claim 3 (depends on 2) The method of claim 2, wherein mapping the overwriting is contemporaneous with the overwriting of the virtual sectors. ### Claim 4 (depends on 1) The method of claim 1, further comprising issuing a certificate of sanitization indicating secure erasure of the selected virtual resource. ### Claim 5 (depends on 1) The method of claim 1, further comprising dereferencing a unique identifier of the selected virtual resource, thereby disassociating a logical layer having the selected virtual resource from the physical layer. ### Claim 6 (depends on 5) The method of claim 5, wherein dereferencing the unique identifier is after overwriting all virtual sectors of the selected virtual resource. ### Claim 7 (depends on 1) The method of claim 1, wherein overwriting all virtual sectors of the selected virtual resource includes overwriting in compliance with a NIST 800-88 standard. ### Claim 8 (depends on 7) The method of claim 7, wherein overwriting all virtual sectors of the selected virtual resource includes overwriting with two passes of random bits and one pass of zero bits. ### Claim 9 (depends on 1) The method of claim 1, wherein the confirming that all virtual sectors of the selected virtual resource have been overwritten uses a hash value. ### Claim 10 (depends on 9) The method of claim 9, the confirming comprising comparing a first hash value determined from a similarly sized zero-byte data file as the selected virtual resource to another hash value of the selected virtual resource after the overwriting. ### Claim 11 (depends on 1) The method of claim 1, further comprising receiving a target host and user credentials. ### Claim 12 (depends on 11) The method of claim 11, further comprising identifying access privileges identified with the user credentials and wherein presenting the virtual resource in accordance with the access privileges. ### Claim 13 (depends on 12) The method of claim 12, wherein presenting virtual resource corresponding to the access privileges includes presenting only if the user has alteration or deletion privileges. ### Claim 14 (depends on 1) The method of claim 1, further comprising determining an environment processing capacity and throttling the overwriting based on the environment processing capacity. ### Claim 15 (depends on 1) The method of claim 1, further comprising identifying the virtual sectors based on usage in an environment distinguishing between allocation and usage. ### Claim 16 (depends on 1) The method of claim 1, further comprising installing an application for performing the method into a user environment. ### Claim 17 A non-transitory computer readable storage medium programmed with computer readable code that, when executed by a computer processor, causes the processor to: present a virtual resource in a user interface; receive a selection of the virtual resource, the selection indicating that the virtual resource is to be securely erased; isolate the selected virtual resource, wherein to isolate the selected virtual resource, the processor: exclusively locks the selected virtual resource, stops execution of virtual machine processes associated with the selected virtual resource, and disables a dynamic redistribution of resources to ensure uninterrupted operation; obtain access to the selected virtual resource; securely erase the selected virtual resource by overwriting all virtual sectors of the selected virtual resource; and confirm that all virtual sectors of the selected virtual resource have been overwritten. ### Claim 18 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the computer readable code further configures the processor to: map the overwriting to a physical layer associated with the virtual sectors of the selected virtual resource. ### Claim 19 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the computer readable code further configures the processor to: issue a certificate of sanitization indicating secure erasure of the selected virtual resource. ### Claim 20 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the computer readable code further configures the processor to: dereference a unique identifier of the selected virtual resource, to disassociate a logical layer having the selected virtual resource from the physical layer. ### Claim 21 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the computer readable code further configures the processor to: overwrite all virtual sectors of the selected virtual resource in compliance with a NIST 800-88 standard. ### Claim 22 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the computer readable code further configures the processor to: confirm that all virtual sectors of the selected virtual resource have been overwritten using a hash value. ### Claim 23 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the computer readable code further configures the processor to: receive a target host and user credentials. ### Claim 24 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the computer readable code further configures the processor to: determine an environment processing capacity and throttle the overwriting based on the environment processing capacity. ### Claim 25 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the computer readable code further configures the processor to: identify the virtual sectors based on usage in an environment distinguishing between allocation and usage.