kmwebnet/OpenSK
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Wipe sensitive data on entry deletion

Browse Source 
When inserting (or replacing) entries in the store, the data may be marked as
sensitive. When that entry is deleted, the data is wiped by overwritting it with
zeroes. This may cost a few bytes of overhead per entry with sensitive data to
satisfy the constraint that words may only be written twice.
This commit is contained in:
Julien Cretin
2020-03-04 18:50:24 +01:00
parent fa4271104d
commit 61a4fb9784
4 changed files with 233 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

172
src/embedded_flash/store/mod.rs
View File

@@ -57,7 +57,7 @@
//! new_page:page_bits
//! Padding(word)
//! Entry := Header Data Footer
//! // Let X be the byte following `length` in `Info`.
//! // Let X be the byte (word-aligned for sensitive queries) following `length` in `Info`.
//! Header := Info[..X] // must fit in one word
//! Footer := Info[X..] // must fit in one word
//! Info :=
@@ -65,6 +65,7 @@
//! deleted:1
//! internal=1
//! replace:1
//! sensitive:1
//! length:byte_bits
//! tag:tag_bits
//! [ // present if `replace` is 0
@@ -109,15 +110,16 @@
//! 0.1 deleted
//! 0.2 internal
//! 0.3 replace
//! 0.4 length (9 bits)
//! 1.5 tag (least significant 3 bits out of 5)
//! 0.4 sensitive
//! 0.5 length (9 bits)
//! 1.6 tag (least significant 2 bits out of 5)
//! (the header ends at the first byte boundary after `length`)
//! 2.0 <user data> (2 bytes in this example)
//! (the footer starts immediately after the user data)
//! 4.0 tag (most significant 2 bits out of 5)
//! 4.2 replace_page (6 bits)
//! 5.0 replace_byte (9 bits)
//! 6.1 padding (make sure the 2 properties below hold)
//! 4.0 tag (most significant 3 bits out of 5)
//! 4.3 replace_page (6 bits)
//! 5.1 replace_byte (9 bits)
//! 6.2 padding (make sure the 2 properties below hold)
//! 7.6 committed
//! 7.7 complete (on a different word than `present`)
//! 8.0 <end> (word-aligned)
@@ -203,6 +205,11 @@ pub struct StoreEntry<'a> {
/// The data of the entry.
pub data: &'a [u8],
/// Whether the data is sensitive.
///
/// Sensitive data is overwritten with zeroes when the entry is deleted.
pub sensitive: bool,
}
/// Implements a configurable multi-set on top of any storage.
@@ -262,6 +269,7 @@ impl<S: Storage, C: StoreConfig> Store<S, C> {
StoreEntry {
tag: self.format.get_tag(entry),
data: self.format.get_data(entry),
sensitive: self.format.is_sensitive(entry),
},
))
} else {
@@ -326,7 +334,7 @@ impl<S: Storage, C: StoreConfig> Store<S, C> {
self.format.validate_entry(new)?;
let mut old_index = old.index;
// Find a slot.
let entry_len = self.replace_len(new.data.len());
let entry_len = self.replace_len(new.sensitive, new.data.len());
let index = self.find_slot_for_write(entry_len, Some(&mut old_index))?;
// Build a new entry replacing the old one.
let entry = self.format.build_entry(Some(old_index), new);
@@ -360,17 +368,20 @@ impl<S: Storage, C: StoreConfig> Store<S, C> {
/// Returns the byte cost of a replace operation.
///
/// Computes the length in bytes that would be used in the storage if a replace operation is
/// executed provided the data of the new entry has `length` bytes.
pub fn replace_len(&self, length: usize) -> usize {
self.format.entry_size(IsReplace::Replace, length)
/// executed provided the data of the new entry has `length` bytes and whether this data is
/// sensitive.
pub fn replace_len(&self, sensitive: bool, length: usize) -> usize {
self.format
.entry_size(IsReplace::Replace, sensitive, length)
}
/// Returns the byte cost of an insert operation.
///
/// Computes the length in bytes that would be used in the storage if an insert operation is
/// executed provided the data of the inserted entry has `length` bytes.
pub fn insert_len(&self, length: usize) -> usize {
self.format.entry_size(IsReplace::Insert, length)
/// executed provided the data of the inserted entry has `length` bytes and whether this data is
/// sensitive.
pub fn insert_len(&self, sensitive: bool, length: usize) -> usize {
self.format.entry_size(IsReplace::Insert, sensitive, length)
}
/// Returns the erase count of all pages.
@@ -410,8 +421,11 @@ impl<S: Storage, C: StoreConfig> Store<S, C> {
let entry_index = index;
let entry = self.read_entry(index);
index.byte += entry.len();
if !self.format.is_alive(entry) {
// Skip deleted entries (or the page padding).
if !self.format.is_present(entry) {
// Reached the end of the page.
} else if self.format.is_deleted(entry) {
// Wipe sensitive data if needed.
self.wipe_sensitive_data(entry_index);
} else if self.format.is_internal(entry) {
// Finish page compaction.
self.erase_page(entry_index);
@@ -449,6 +463,31 @@ impl<S: Storage, C: StoreConfig> Store<S, C> {
/// The provided index must point to the beginning of an entry.
fn delete_index(&mut self, index: Index) {
self.update_word(index, |format, word| format.set_deleted(word));
self.wipe_sensitive_data(index);
}
/// Wipes the data of a sensitive entry.
///
/// If the entry at the provided index is sensitive, overwrites the data with zeroes. Otherwise,
/// does nothing.
fn wipe_sensitive_data(&mut self, mut index: Index) {
let entry = self.read_entry(index);
debug_assert!(self.format.is_present(entry));
debug_assert!(self.format.is_deleted(entry));
if self.format.is_internal(entry) || !self.format.is_sensitive(entry) {
// No need to wipe the data.
return;
}
let gap = self.format.entry_gap(entry);
let data = gap.slice(entry);
if data.iter().all(|&byte| byte == 0x00) {
// The data is already wiped.
return;
}
index.byte += gap.start;
self.storage
.write_slice(index, &vec![0; gap.length])
.unwrap();
}
/// Finds a page with enough free space.
@@ -555,10 +594,13 @@ impl<S: Storage, C: StoreConfig> Store<S, C> {
} else if self.format.is_internal(first_byte) {
self.format.internal_entry_size()
} else {
let header = self.read_slice(index, self.format.header_size());
// We don't know if the entry is sensitive or not, but it doesn't matter here. We just
// need to read the replace, sensitive, and length fields.
let header = self.read_slice(index, self.format.header_size(false));
let replace = self.format.is_replace(header);
let sensitive = self.format.is_sensitive(header);
let length = self.format.get_length(header);
self.format.entry_size(replace, length)
self.format.entry_size(replace, sensitive, length)
};
// Truncate the length to fit the page. This can only happen in case of corruption or
// partial writes.
@@ -673,7 +715,7 @@ impl<S: Storage, C: StoreConfig> Store<S, C> {
// Save the old page index and erase count to the new page.
let erase_index = new_index;
let erase_entry = self.format.build_erase_entry(old_page, erase_count);
self.storage.write_slice(new_index, &erase_entry).unwrap();
self.write_entry(new_index, &erase_entry);
// Erase the page.
self.erase_page(erase_index);
// Increase generation.
@@ -728,6 +770,22 @@ impl<C: StoreConfig> Store<BufferStorage, C> {
pub fn set_erase_count(&mut self, page: usize, erase_count: usize) {
self.initialize_page(page, erase_count);
}
/// Checks whether all deleted sensitive entries have been wiped.
pub fn check_wiped(&self) {
for (_, entry) in Iter::new(self) {
if !self.format.is_present(entry)
|| !self.format.is_deleted(entry)
|| self.format.is_internal(entry)
|| !self.format.is_sensitive(entry)
{
continue;
}
let gap = self.format.entry_gap(entry);
let data = gap.slice(entry);
assert!(data.iter().all(|&byte| byte == 0x00));
}
}
}
/// Maps an index from an old page to a new page if needed.
@@ -843,7 +901,27 @@ mod tests {
let tag = 0;
let key = 1;
let data = &[key, 2];
let entry = StoreEntry { tag, data };
let entry = StoreEntry {
tag,
data,
sensitive: false,
};
store.insert(entry).unwrap();
assert_eq!(store.iter().count(), 1);
assert_eq!(store.find_one(&key).unwrap().1, entry);
}
#[test]
fn insert_sensitive_ok() {
let mut store = new_store();
let tag = 0;
let key = 1;
let data = &[key, 4];
let entry = StoreEntry {
tag,
data,
sensitive: true,
};
store.insert(entry).unwrap();
assert_eq!(store.iter().count(), 1);
assert_eq!(store.find_one(&key).unwrap().1, entry);
@@ -857,6 +935,7 @@ mod tests {
let entry = StoreEntry {
tag,
data: &[key, 2],
sensitive: false,
};
store.insert(entry).unwrap();
assert_eq!(store.find_all(&key).count(), 1);
@@ -866,6 +945,25 @@ mod tests {
assert_eq!(store.iter().count(), 0);
}
#[test]
fn delete_sensitive_ok() {
let mut store = new_store();
let tag = 0;
let key = 1;
let entry = StoreEntry {
tag,
data: &[key, 2],
sensitive: true,
};
store.insert(entry).unwrap();
assert_eq!(store.find_all(&key).count(), 1);
let (index, _) = store.find_one(&key).unwrap();
store.delete(index).unwrap();
assert_eq!(store.find_all(&key).count(), 0);
assert_eq!(store.iter().count(), 0);
store.check_wiped();
}
#[test]
fn insert_until_full() {
let mut store = new_store();
@@ -875,6 +973,7 @@ mod tests {
.insert(StoreEntry {
tag,
data: &[key, 0],
sensitive: false,
})
.is_ok()
{
@@ -892,6 +991,7 @@ mod tests {
.insert(StoreEntry {
tag,
data: &[key, 0],
sensitive: false,
})
.is_ok()
{
@@ -903,6 +1003,7 @@ mod tests {
.insert(StoreEntry {
tag: 0,
data: &[key, 0],
sensitive: false,
})
.unwrap();
for k in 1..=key {
@@ -916,7 +1017,11 @@ mod tests {
let tag = 0;
let key = 1;
let data = &[key, 2];
let entry = StoreEntry { tag, data };
let entry = StoreEntry {
tag,
data,
sensitive: false,
};
store.insert(entry).unwrap();
// Reboot the store.
@@ -934,10 +1039,12 @@ mod tests {
let old_entry = StoreEntry {
tag,
data: &[key, 2, 3, 4, 5, 6],
sensitive: false,
};
let new_entry = StoreEntry {
tag,
data: &[key, 7, 8, 9],
sensitive: false,
};
let mut delay = 0;
loop {
@@ -973,6 +1080,7 @@ mod tests {
.insert(StoreEntry {
tag,
data: &[key, 0],
sensitive: false,
})
.is_ok()
{
@@ -983,7 +1091,14 @@ mod tests {
let (index, _) = store.find_one(&1).unwrap();
store.arm_snapshot(delay);
store
.replace(index, StoreEntry { tag, data: &[1, 1] })
.replace(
index,
StoreEntry {
tag,
data: &[1, 1],
sensitive: false,
},
)
.unwrap();
let (complete, store) = match store.get_snapshot() {
Err(_) => (true, store.get_storage()),
@@ -995,7 +1110,11 @@ mod tests {
assert_eq!(store.find_all(&k).count(), 1);
assert_eq!(
store.find_one(&k).unwrap().1,
StoreEntry { tag, data: &[k, 0] }
StoreEntry {
tag,
data: &[k, 0],
sensitive: false,
}
);
}
assert_eq!(store.find_all(&1).count(), 1);
@@ -1012,7 +1131,11 @@ mod tests {
#[test]
fn invalid_tag() {
let mut store = new_store();
let entry = StoreEntry { tag: 1, data: &[] };
let entry = StoreEntry {
tag: 1,
data: &[],
sensitive: false,
};
assert_eq!(store.insert(entry), Err(StoreError::InvalidTag));
}
@@ -1022,6 +1145,7 @@ mod tests {
let entry = StoreEntry {
tag: 0,
data: &[0; PAGE_SIZE],
sensitive: false,
};
assert_eq!(store.insert(entry), Err(StoreError::StoreFull));
}