Pieter H. Hartel Leon Abelmann Mohammed G. Khatib
Fac. of Electrical Engineering, Mathematics and Computer Science,
Univ. of Twente, P.O. Box 217, 7500 AE Enschede, The Netherlands,
To deal with tampering on a technical level a large variety of disk, tape, and optical Write Once Read Many (WORM) technologies have been developed that are designed [15] to resist or at least to help detect tampering. Unfortunately, tamper resistance is a hard problem [3] that none of the existing storage technologies actually provide. For example, there is nothing to stop a dedicated attacker from tampering with a Read-only Memory (ROM) [4]. On the other hand it is difficult to cover the traces of tampering with a ROM. Mass storage such as disk, tape and optical disk is probably just as easy to tamper with as ROM, so we believe that we should put our efforts in improving the tamper evidence of mass storage.
It is always difficult to find the right balance between security and usability, and tamper evidence of mass storage is no exception to this rule. To guide the discussion we analyse how mass storage is used. Probably most applications use a data base, which requires efficient random reads and writes. Tampering with data is easy, as any record can simply be rewritten. Therefore most data bases support a snapshot operation that freezes the contents of the data base, for instance for auditing purposes, recovery, etc. If the snapshot is written to a disk, the attacker will find it as easy to tamper with the snapshot as it is easy to tamper with the live database. If on the other hand the snapshot is written to an optical WORM device, tampering would be more difficult to hide. Unfortunately the WORM device also has an impact on the way the snapshot can be read, as the performance characteristics of hard disk and optical disk are different. An ideal solution would combine the performance of the hard disk with the tamper evidence of the optical disk. In other words we require not a WORM device but a Selectively Eventually Read-only (SERO) device, i.e., a device that begins life as a Write Many Read Many (WMRM) device, selected parts of which are subjected to Write Once (WO) operations, and which ends life as a Read-only (RO) device.
The construction of a SERO device is still a long way away, but in this paper we would like to lay the physical foundation for the medium used in such a device, also giving the design considerations for a device and a file system that would support SERO storage. Our proposal combines an idea of Molnar et al. [31] for tamper-evident storage with our own work on patterned media. We introduce each of these two elements below.
Molnar et al. [31] describe how standard Programmable Read-Only Memory (PROM) can be used to build tamper-evident storage. The basic idea is to store each bit of information in a cell occupying two bits using Manchester encoding: the logical bit 1 is encoded as the cell 10 and the logical bit 0 is encoded as the cell 01. The value 11 indicates a cell that has not yet been used (all cells in a PROM are initialized to 11). The value 00 indicates a cell that has been tampered with for the following reason. The physical properties of a PROM make it impossible to change a 0 back into a 1 (except by exposing the entire memory module to ultra violet light, which would reset all cells to 11). Therefore, the only way to tamper with information (which is encoded as 01 or 10) is to clear a bit. This immediately results in an invalid cell 00, which provides the evidence of tampering.
A patterned medium [52] consists of a regular arrangement of magnetic dots separated by sub-micron distances that can be magnetised in two directions along a fixed magnetic axis. A magnetic dot can be read and written magnetically any number of times. However, by precise local heating of a dot, the orientation of the magnetic axis of the dot can be changed irreversibly. The idea is to use this feature to create a storage device that begins life as a WMRM device, reading and writing dots magnetically. After heating, a dot can no longer be read or written magnetically, but the fact that a dot has been heated can be detected. From then on the heated parts of the medium operate as a tamper-evident RO device, while the rest of the medium continues to operate as a WMRM device. The ability to heat parts of the medium incrementally provides flexibility that cannot be matched by current WORM technology. (The operation we call ``heating" is usually called ``freezing" in the literature, but given the physical realisation of the operation we decided to stay with the term heating.)
In the rest of the paper, we discuss the issues that must be addressed for the combination of tamper-evident storage and patterned media to result in a SERO device with the following properties. Firstly, like a hard disk, the device is expected to offer random WMRM access to a large number of blocks with a total capacity of the order of 1 Terabit [39]. Secondly, the device is expected to be capable of a WO operation of a block by heating the magnetic dots of the block. After the WO operation the block is RO. We will also refer to the WO operation of a block as heating a block. Finally, heating a block is expected to be relatively slow. Therefore, the device is expected to be able to heat a contiguous sequence of blocks, henceforth referred to as heating a line, by (a) calculating a secure hash of the line, and (b) applying a WO operation on the first block of the line to record the hash.
Our proposal does not use cryptographic keys. We provide only data integrity (using secure hashing and hardware support) but no confidentiality or authenticity. Our proposal is thus complementary to the vast amount of work on using symmetric and public key cryptography to provide storage with confidentiality and authenticity, and our work could be combined with many of the existing approaches.
Related work is discussed in the next section. Then we speculate on the feasibility of a device (Section 3), and a file system (Section 4) for SERO storage. A security analysis of the hypothetical SERO file system and device is presented in Section 5. We describe concrete examples of an actuator (Section 6), and a medium (Section 7) that could be used to build a SERO device. Section 8 discusses open issues. The last section concludes and suggests further work.
All the approaches mentioned rely on something external to system that is intended to deliver the secure store (i.e., separate hardware, separate servers and/or separate clients). Our approach relies on hardware support, while improving the flexibility beyond what a typical WORM system can offer.
Physical WORM technologies using optical media and tape are widely used. Optical WORM technologies offer a high level of integrity but the cost of ownership is higher than that of disk-based technologies. For example CDROMs are cumbersome to manage (because they have a small capacity, which leads to large collections of CDs), and professional optical storage systems are expensive (because they often contain mechanical robots). Tape based technologies are generally inexpensive but offer integrity at the medium level only. For example a tape cartridge in the Linear Tape-Open 3 (LTO-3) industry standard has a small semiconductor memory in which a read-only flag can be set [21], such that a compliant tape drive will refuse to write on such a cartridge. The tape itself can still be written using a tape drive that has been tampered with, or after tampering with the cartridge.
Software based WORM technologies are based on the idea that the disk driver or the firmware of the disk can be modified to block future writes to selected areas of the disk. The integrity offered by this approach is relatively weak, as software modifications can generally be undone. There are many Virtual Tape Library products in the market that depend on software based WORM technologies [55].
An IBM patent [56] proposes to connect the write signal of a disk head via a blowable fuse such that once the fuse is blown, an entire disk platter becomes immutable. This offers a high level of relatively coarse grained integrity. As in the case of the LTO-3 tape standard, the platter is still writeable but it would be more difficult to repair the fuse in the head than it is to tamper with an LTO-3 tape drive.
The modification of the magnetic properties of a multilayered patterned medium is relatively easy. The first experiments were performed with Ga ions from a Focussed Ion Beam [50], using modest irradiation doses. The magnetic properties of the material are modified by displacement of the interface atoms, and inclusion of Ga. By using lighter ions, such as He
, the incorporation of ions can be avoided, and only interface mixing results [41]. As a result, the easy axis of magnetisation rotates from perpendicular to in-plane. By using shadow masks to shield from the impingement of ions, these irradiation techniques can be used to pattern multilayered films into areas with perpendicular and in-plane magnetisation. These types of patterned medium have the advantage that the surface remains flat.
In this work we suggest to use temperature-assisted interface mixing to destroy magnetic dots selectively. On the effect of heat treatment of multilayer materials, much less is known, primarily because it is considered a detrimental effect that cannot be used for patterning. Encouraging experiments show however that at relatively low temperatures of about 300 
C, interface mixing occurs between Co (magnetic) and Pt (non-magnetic) [46]. Heat treatment can however also have beneficial effects on the interfaces. In Co/Cu systems for instance, the interfaces are found to enhance at temperatures of 300 C [7]. Most likely this has to do with the solubility of both materials. Therefore the material combination has to be chosen with care. Even so, it is possible to damage the films at higher temperatures. In the same Co/Cu system, at 700 C grains start to grow and the Co layers start to coalesce, thus destroying the interface completely. From these experiments we can conclude therefore that thermal destruction of the magnetic properties by interface mixing is in principle possible, provided that the right material combination is chosen.
This concludes the survey of related work on all relevant aspects of tamper-evident data storage.
 |
![\begin{figure}{\large
\begin{center}\entrymodifiers ={++[o][F-]}
\SelectTips{c...
...athsf{ewb}}\ar@(ur,dr)[]^{\mathsf{mwb~0/1}}
& *{}
}
\end{center}}\end{figure}](img8.png) |
The magnetic write bit operation 
sets the direction of the magnetisation (up is 1, down is 0) and the corresponding magnetic read bit operation 
senses the direction of the magnetisation. The signal measured by the read heads is shown schematically, indicating a positive peak for the first and the last dot, and a negative peak for the middle dot. The top half of Figure 2 illustrates the transitions from 
to 
and vice versa, as effectuated by the magnetic write operations on the state of an individual bit.
heats an individual dot by means of an electric current flowing from the probe tip via the dot to the medium. This heating causes the multilayer structure of a dot to be destroyed and as a result the easy axis of magnetisation rotates into the medium. The data stored by magnetic write operations is lost. Now, we have a third way of representing data, indicated by the letter 
(for heated), and effectuated by the operation. (We will also indicate un-heated bits by the letter 
). The bottom half of Figure 1 shows that the layered structure of the last dot is permanently destroyed. The peak in the magnetic read signal for the last bit has disappeared. The electrical write bit operation is an irreversible process, which can only change a 0/1 bit into a , as shown by the one-way transitions from the states and in the top half of Figure 2 to the state . (See Section 7 for detail on the physics.)
Strictly speaking there is no electrical read bit operation 
; instead is built out of magnetic read and write operations. The operation detects the presence or absence of an out-of-plane dot by performing an atomic sequence of and operations as follows:
to read the original bit;
to write the inverse of the original bit;
of the inverse to verify that the inverse can indeed be read back;
to write the original again;
to verify that the original can indeed be read back.
return , else returns (the two inversions ensure that the original magnetic data is restored for dots that have not been heated).
The operation is at least 5 times slower than , and is also slower than because of the local heating process. Therefore, as stated before, the idea is to use the and operations sparingly.
As illustrated in Figure 2 (bottom right), applying a single operation to an electrically written bit would yield a more or less random result. To avoid this, the device must follow the proper protocol which means that magnetically written data must only be read magnetically and that electrically written data must only be read electrically. A simple way to achieve this is by reserving specific physical areas for electrical data while using other areas for magnetic data. As we shall see below, this rigid segregation of electrical and magnetic data puts severe constraints on the design of the device and the file system. An alternative would be to read the in-plane magnetic signal directly, however, this requires carefully constructed elliptic dots to ensure that the direction of the in-plane magnetization is known (See Section 7).
and a magnetic write sector operation 
using the magnetic read and write operations for bits described above, and taking error correction appropriate to the medium, the tips, etc. into account. Henceforth we will talk about a block as the smallest unit of storage, and for simplicity we assume that a block is a single sector. Similarly we can build an electrical read sector operation 
and an electrical write sector operation 
using the electrical read and write operations for bits described above.
 |
operation works on a line, which is a sequence of 
contiguous blocks aligned on a boundary. When given a line, the operation performs the following atomic sequence of steps:
representing the line to be protected using 
calls to ;
using the electrical write operation , this leaves 4096-512=3584 bits of space for meta data, signatures, etc.;
, or else fail.
of a heated line can still be read magnetically, hence efficiently, and as often as needed. Figure 3 illustrates the result of the operation. The last blocks are written magnetically, shown as zeros and ones. Block 0 is written electrically in a Manchester encoding, where each logical bit of the hash occupies two physical bits on the medium. The Manchester encoding ensures that a heated bit (i.e., an ) has at most one heated neighbour. Since each electrical write may be expected to have a detrimental effect on the neighbouring bits, spreading out heated bits is good for reliability.
The operation, when applied to a line that has already been heated either has no effect and is therefore harmless (if the data in block 0 is invariant) or it will turn Manchester encoded bits into 
, thus providing evidence of tampering.
operation computes the hash of a line and compares the computed hash to the electrically written hash. A mismatch represents evidence of tampering.
As a SERO device ages, slowly but surely parts of the storage become RO, such that the WMRM area not only shrinks but it might also become fragmented. Considering that it does not make sense to move a RO line (because this would not leave behind usable space), the file system has an important task in avoiding fragmentation of heated lines.
Interestingly, part of the answer to the question we posed at the beginning of this section is provided by Rosenblum and Ousterhout, who observe that when the read cache is large enough, disk I/O is dominated by writes. Therefore, the disk has the best chance of keeping up with the CPU if writes are clustered [42]. Many file systems have since been proposed that cluster writes. From a write performance point of view it makes no difference whether the blocks in a cluster are related, for instance when the blocks are part of the same file or when the blocks are unrelated. However, from the SERO point of view it does make a difference whether blocks are related, because it does not make sense to heat a line of unrelated blocks. In the end, it depends on the application whether or not clusters of related blocks are likely to occur. For instance, taking a data base snapshot would probably result in a cluster of related blocks.
So why does clustering help our SERO device? Clustering makes it possible to take a contiguous sequence of related blocks, to hash the data stored in those blocks, and to use the WO operation to store the hash of the sequence. The advantages of clustering are twofold. Firstly, the larger the cluster, the lower the overhead of the hash can be. Secondly, the WO operation is expected to be considerably slower than the WM operation, and clustering allows the WO operation to be used sparingly.
We will now have a closer look at the original log-structured file system [42]. LFS treats the space on the disk as a collection of contiguous segments, each of which consists of a contiguous sequence of blocks. This collection of segments is called the log. New data is written sequentially to the log and the log is filled incrementally.
An LFS has to manage data blocks and free blocks on the storage device, while keeping the performance of the disk as high as possible. To achieve this performance goal, it (1) accumulates small writes and commits them to the disk in a single operation, and (2) gathers related but scattered blocks, removing dirty blocks by running the garbage collector.
The presence of heated lines complicates the tasks of the LFS. This is because once a line has been heated it cannot be copied by the garbage collector, since a heated line leaves no reusable space behind. Copying a heated line just decreases the free space that can be potentially used for new data. Therefore, like clustering of related blocks, heated lines should also be clustered.
Based on the behaviour of the application, it should be possible to predict which lines will be heated at the same time. Therefore, during garbage collection, the file system may cluster lines into segments, that are likely to be heated at the same time. As a result of such a clustering policy, the file system creates a bimodal distribution of heated segments; that is we have only mostly heated segments and mostly unheated segments. As a result, (1) the performance of reading/writing blocks should not be affected much, since heated lines and WMRM live data blocks are kept separate, (2) space decreases only if new data is written and not when lines are heated, since lines are heated in the right place, avoiding the need to copy them, and (3) the garbage collector skips over heated segments, avoiding reading and writing them repeatedly, thus saving on disk bandwidth. Summarizing, the bimodality should help to keep the performance high in the presence of heated lines.
Other file systems do not use a log, but pack data into clusters. For example, the Berkeley Fast File Systems (FFS) [44] uses clusters to pack small files with their metadata, or to pack related blocks of large files into the same cluster. The discussion above on bimodality holds for these file systems as well; FFS-like clustering policies should maintain mostly heated clusters and mostly unheated clusters.
So why does hashing help to protect the integrity of the data? Basically because it is easy to compute a hash from a group of disk blocks, while it is hard to find another set of disk blocks with the specific hash. We discuss two file systems for archival storage that use hashes extensively. The first builds an index structure from the leaves up, and the second builds the index from the root down.
Venti [40] uses a secure hash as the address of a node, where a node consists of a block of data or hashes. Venti builds a hierarchy of nodes from the leaves upwards by storing the hashes of the children of a node in the parent. The hash of the root node represents the entire hierarchy. As long as the hash of the root is stored securely, tampering can be detected. To check a node we use the hash of the node as its address, then re-compute the hash of the node, and finally compare the computed hash to the address. A computed hash that does not match the address of the node presents evidence of tampering.
A SERO device would be appropriate to keep the hash of a node secure. For simplicity, assume that the granularity of a node in the Venti hierarchy is a line. Then heating the line that represents a node is sufficient to calculate and store the hash of the line RO. The most relevant node to be heated is the root node, because this protects the entire hierarchy.
Venti lays different hierarchies on the data blocks to be able to record different snapshots of the file system (for example one for every working day). The same idea can also be used to construct hierarchies for different subsets of the data, such as the data accessible to different users, of different projects, etc. This would offer fine grained protection. However, the more nodes are heated, the more WMRM space on the medium is reduced to RO space, thus resulting in a reduction in usability.
A fossilised index [57] builds a tree from the root downwards. To insert a new node in the tree we start at the root, visiting all nodes down to a leaf until a free slot is found in which the hash of the new node can be inserted. The hash of the node completely determines which slot in an existing node must be used, and what path to traverse. The tamper evidence guarantee of the fossilised index relies on the assumption that once all the slots of a node have been filled, the storage device ensures that the node becomes RO, for example by copying it to a WORM device.
A SERO device would provide appropriate support for a fossilised index as it makes copying the completed node to the WORM unnecessary. Again, assuming that a node fits in a line, a completely filled node is simply heated.
In terms of the threat model of Hasan et al. [14], the attacker capability is that of a powerful insider wielding influence over systems and the personnel responsible for the systems. The attacker has root permission on all systems connected to the storage device. The asset goal is the integrity and availability of specific files that the attacker wishes to compromise. The access entry point is the whole system stack including direct access to the storage device. The attacker is expected to be able to disconnect the storage device temporarily from the system, then to connect it to a laptop with the appropriate interface for a limited period of time, and after he has finished to reconnect the device to the system.
This threat model represents a formidable challenge to the design of any secure storage system. For example some of the existing commercial WORM-based storage systems make it difficult to tamper with data, but on most systems tampering cannot be detected. We are not able to prevent tampering either, but we are able to detect tampering. We believe this to be a significant step towards addressing the challenge of secure storage.
WORM storage is geared towards providing integrity and availability. Therefore we will analyse to what extent our SERO system can cope with threats on integrity and availability. To ensure confidentiality or authenticity cryptographic techniques should be used, but this is beyond the scope of our paper.
hash: Changing the magnetisation of an electrically written bit of the hash has no effect, as only the presence or the absence of a magnetic dot is relevant for a heated hash.
inode/data: Changing the magnetisation of a magnetically written bit of the data is detected by the
operation as evidence of tampering.
hash: The only changes possible to an electrically written hash are
or
. is an illegal code, and thus represents evidence of tampering.
inode/data: Data is read magnetically, so an electrically written bit in the data, which destroys the magnetic properties of the relevant dot, appears as a read error. However, a more subtle attack would be an attempt to split a file or to coalesce two files. To illustrate such an attack imagine a heated file as shown below, where the data block 
is carefully crafted to look like a valid hash 
and where the data block 
looks like a valid inode 
:
| before: |  |
 |
 |
... |  |
|
|
... |  |
|||||||||
| after: | |
|
|
... | |
|
|
... | |
, the device has no way of telling whether this is a true file, or just part of the data of another file. Hence after heating, the original file with inode would appear corrupted whereas the new file with inode appears to be genuine, quite the contrary of what we expect. Similarly, if the hashes are not in well-defined locations it is possible to coalesce two files making the result look genuine instead of the original. To prevent splitting or coalescing attacks, the device insists that hashes are written at known physical addresses.
Assume that the attacker tries to delete a heated file using the rm command. This removes the directory entry and tries to decrement the reference count in the inode. This implies writing the inode, which will be tamper-evident because the hash is invalidated. (Incidentally, it will not be possible to use the ln command on a heated file either, as this would increase the reference count in the inode.) A possible protection against malicious use of the rm command would be to maintain the directory as a fossilised index [57].
Assume that the attacker would like to create an exact copy of file to mask the existence of the original. This cannot be done since the physical addresses of the blocks are included in the calculation of the hash. Therefore, a copy can always be distinguished from an original.
Assume that the attacker clears the directory structure, then a fsck style scan of the medium would definitely recover (albeit slowly) all the heated files.
Assume that the attacker clears the entire medium, for example using a bulk eraser. If done properly [12], this would clear all magnetically written information. However all electrically written information is still present, thus providing the required evidence of tampering.
There are many attacks possible that our system cannot detect. For example assume that an attacker creates a new file with data that conflicts with the file the attacker wishes to remove. Firstly, the notion of conflicting data is a semantic notion that can only be resolved by the application. Secondly, this is not an attack on the integrity of the file per se (as the original remains untouched), but an attack on the authenticity. To prevent such attacks, cryptographic means are needed.
This concludes the preliminary security evaluation of the system, and also the speculative part of the paper. The next two sections describe the components of a SERO device and experimental evidence that heating is a feasible WO operation.
 |
 |
SPAM) (Figure 4), which is made out of two or more silicon wafers bonded to each other. One half contains the (magnetic) medium. An electrostatic stepper actuator, such as the Walker [48] or Harmonica drive [43] is used to move the medium. The other half consists of one large array of probes.
SPAM is a regular matrix of magnetic single domain dots. Such a discrete medium is expected to be able to support higher bit densities compared to the continuous polycrystalline medium used in the hard disk today [51].
A matrix with a period of 200 nm can be achieved [53]. A scanning electron microscope and magnetic image is shown in Figure 7. An improved setup with periodicities down to 150 nm has recently been realised [25], and a period of 100 nm (being 50 nm dot size and 50 nm spacing) should be achievable. This will give a capacity of 10 Gbit/cm
(=65 Gbit/inch).
SPAM uses the MFM (Magnetic Force Microscopy)-principle [38]. An MFM-probe is made by placing a small magnetic element, the tip, on a cantilever spring. Typical dimensions are a cantilever length of 200 m, element length of 4 m and diameter of 50 nm and a distance from the surface of 30 nm.
Figure 6 shows the principle of an MFM-measurement. The magnetic tip is attracted or repelled, depending on the stray field of the medium. The tip is affected by the magnetic orientation of a dot. The displacement of the cantilever might be measured by means of the change in capacity between the cantilever and the medium. Bits can be written by the combined field of the magnetic tip on one side of the medium and an externally applied field generated by a coil placed on the other side of the medium [53].
The magnetic field energy is minimal when the magnetisation lies in the long axis of an object. The preferential direction of magnetisation in a needle is for instance along the needle, and not perpendicular to it. Since our dots are circular disks with a diameter much larger than the thickness, the magnetisation prefers to lie within the plane of the disk in the absence of any other energy contributions. The fact that the energy depends on the orientation of the magnetisation is called anisotropy. The preferred direction is called an easy axis. In the case of a dot which is perfectly circular, we speak of an easy plane. Normally dots will not be exactly circular, but elliptic. The magnetisation of the dot will prefer to lay in-plane along the long axis of the dot. By intentionally realising elliptic dots with their long axis along the track direction [32], data detection will be more robust and one can even imagine writing data into damaged dots (See the discussion of the operation in Section 3). Since the anisotropy is low, data density cannot be high however. In any case, magnetic dots with a diameter larger than their thickness will a priori have an in-plane easy axis.
For our system to work, we initially need dots with a perpendicular easy axis. Therefore a second strong energy contribution is needed to overcome the stray field energy and force the magnetisation perpendicular to the dot. This second energy term originates from the asymmetric arrangement of the atoms in the dot. In conventional perpendicular hard disk media, specific crystal structures are used to induce perpendicular anisotropy. These can however not easily be destroyed. In our case therefore we use interface properties. The magnetic material used in the dots consists of a stack of extremely thin Co and Pt layers, each no more than 1 nm thick [53]. The interfaces between the Co and Pt films cause anisotropy with the easy axis perpendicular to the interfaces.
Due to the delicate structure of these films, they do not support high temperatures over long periods of time. Above a certain temperature, the interface between the Co and Pt mixes, and the perpendicular interface anisotropy is destroyed. As a result the easy axis of magnetisation rotates back into the film plane. This is an irreversible process. After heat treatment, the interfaces cannot be restored.
To determine at which temperature interface mixing occurs, we have measured the anisotropy constant 
of samples subjected to six different temperatures. The anisotropy constants were calculated by a Fourier transformation of the torque curve obtained with an applied field of 1350 kA/m. Figure 7 shows the dependence of the anisotropy value as a function of the heating, or annealing, temperature. (In materials science it is common to use the word annealing rather than heating, since it describes the proces rather than the method.)
The perpendicular anisotropy of the unannealed film is 80 kJ/m
. This value is maintained up to an annealing temperature of 500 C. Above 600 C the value of drops dramatically. This means that for this particular film, heating temperatures over 500 C will be required for permanent modification of the magnetic properties.
 |
To investigate what happens to the interface between the Co and Pt in the films, we performed X-ray diffraction experiments. In this method the film is exposed to a non-destructive X-ray. The beam penetrates metals, and reflects from discontinuities such as atomic crystal planes or film interfaces. By varying the angle of incidence, reflections from parallel planes at specific spacing add up and we observe a peak in the reflected intensity. In conventional operation (at high angles of incidence, so we observe spacings in the order of Angstroms), we can therefore determine the crystal structure of the film. At low angle of incidence we are sensitive to much larger spacing (1 nm) and we can observe the multilayer structure. The unannealed sample and a sample annealed at 700 C were investigated by low angle X-ray diffraction (XRD) (Figure 8). A peak around 8 degrees on the 2 
axis is visible on the sample without annealing. This peak is due to the periodicity of the Co and Pt multilayers. From this angle, we can calculate that layer has a thickness of 0.6 nm. In the annealed sample, this peak has disappeared, which clearly shows that after an annealing treatment at a temperature higher than 600 C, the interfaces have mixed, the perpendicular anisotropy is lost and the out-of-plane magnetic properties of the film are destroyed.
 |
One might worry that by heating the interfaces are destroyed, but crystal structures are formed which induce perpendicular anisotropy. To study the change in crystal structure, we measured the samples by high-angle-XRD, so that we are sensitive to Angstrom spacing (Figure 9). In the annealed sample, we can find a strong reflection peak around 41.7 degrees in the 2 axis. This peak can be characterized to a specific Co-Pt (111) crystal plane (face centered cubic, fcc). It suggests that indeed a new crystalline structure of fct Co-Pt was formed in the film. This crystal exhibits however magnetic anisotropy in the [001] direction, i.e., there are tilted magnetic easy axes in the film (not perpendicular, not in plane). So there is no risk that after excessive heating the perpendicular anisotropy can be restored by crystallisation.
We envisage that heating of the magnetic dots will be realised by passing a current from the probe tip to the dot. It has been shown in earlier work that these currents are even capable of evaporating the material, so the energy density is sufficiently high [36,35]. This method is not only limited to probe storage however. Active research is being performed into hard disks with heat assisted writing strategies [28]. It is not fundamentally impossible that the supplied energy can be high enough to modify the magnetic properties of the disk permanently. In principle this method could therefore also be used in magnetic disk drives, although the implementation would be far more difficult.
More research will be needed to determine the time required, the amount of energy dissipated, the wear on the tip, and the effect of heating one dot on the neighbouring dots. Especially the last effect could be detrimental, since the magnetic state, or even the write-ability of the adjacent dot could be affected. However, it is not unlikely that by tailoring the materials and layer structures, the interface mixing temperature can be reduced, which will reduce the risk of thermal erasure of the neighbouring dots. Furthermore, by properly designing the thermal properties of the dot and the substrate, most of the heat can be conducted away into the substrate, rather than dissipating away laterally, like is done in magneto-optic medium [29]. In this way the heated area can be limited and damage to adjacent dots can be reduced. In any case it will be necessary to use the write-once operation sparingly.
the amount of space wasted is negligible (1 block out of ), but the price to pay is lack of flexibility. For small values of we could employ more efficient coding techniques [33].
Secondly, the storage system as we have described it behaves as mass storage that can be read and written any number of times as one would expect, except that once an area has been heated, it can no longer be rewritten with impunity. This means that over the lifetime of the device, the read/write area gradually shrinks, and the read-only area grows, until the device has become a pure read-only device. The medium can safely be decommissioned by the time all data has expired. This means that the lifetime of the data must be matched to the lifetime of the medium.
operation on the device (similar to what has been achieved for optical storage [45]), which in our case would physically destroy the expired data by precise local heating. However, both approaches are vulnerable to attacks by a dishonest CEO and as such not wholly satisfactory. We would advocate data to be segregated by expiry date, thus making it possible to take a device physically out of service. Given the enormous volume of data subject to compliance regulation [54] this should be possible to arrange.
We are confident that even a skilled focused ion beam (FIB) operator would find it difficult to reconstruct a perfect out-of-plane dot because she would have to remove the debris of an in-plane dot first, and then deposit several thin Co and Pt layers in a sub-micron area with the correct delicate layer structure to obtain perpendicular anisotropy, just to reconstruct one dot. Using magnetic imaging techniques [27], a forensics team would probably have no difficulty identifying a reconstructed out-of-plane dot from an original out-of-plane dot.
We have identified the most relevant issues in the design of the system. However, much work remains to be done. On the software side we plan to design and build a simulation of the device and the file system, such that we can study the performance/security tradeoffs. The next step would be to develop a time-accurate emulator for the device, as well as an implementation of the file system to validate the simulation results. The time-accurate emulator could probably be built using anti-fuse based write once semiconductor memory technology as used in FPGAs. On the hardware side we plan to develop materials that change magnetic properties by interface mixing at lower temperatures, and tips that generate enough heat for interface mixing, studying the efficiency and reliability of the mechanisms involved.
N
cantilever array on CMOS
circuit for high density probe-based data storage.
, Ar, and Ga ion irradiation.
This document was generated using the LaTeX2HTML translator Version 2002-2-1 (1.70)
Copyright © 1993, 1994, 1995, 1996,
Nikos Drakos,
Computer Based Learning Unit, University of Leeds.
Copyright © 1997, 1998, 1999,
Ross Moore,
Mathematics Department, Macquarie University, Sydney.
The command line arguments were:
latex2html -split 0 -show_section_numbers -local_icons -no_navigation secstor.tex
The translation was initiated by Mohammed Khatib on 2008-01-13
indicates a bit that has not been heated.
represents an electrically written, Manchester encoded logical 0 and 
represents a logical 1.
