Security Vulnerabilities in 3D NAND Flash Memory: Challenges in Data Sanitization and Reverse Engineering

Abstract

Non-volatile flash memory, the fundamental component of solid-state storage devices, provides compact, high-capacity, and low-power storage across a wide range of applications, including consumer electronics, automotive, military, industrial, healthcare, and enterprise systems. The global flash memory market currently exceeds $60 billion and is projected to surpass $80 billion by 2030. However, flash memory poses fundamental challenges for secure data management due to its unique architecture. Data can be written at the page level but erased at the block level, preventing instantaneous in-place updates. These architectural limitations make reliable data deletion difficult and can lead to unintended data remanence. This dissertation investigates security vulnerabilities, data sanitization limitations, and reverse engineering techniques in 3D NAND flash memory. First, we analyze the existing overwrite-based sanitization method and show that it can introduce unintended disturbances to neighboring cells, potentially affecting stored data. To address this issue, we propose the PULSE technique to mitigate overwrite-induced effects while ensuring reliable sanitization. Next, vulnerabilities of the block erase operation are studied. We show that data can persist even after a block erase operation, which is traditionally considered to fully remove stored information, and we develop a method to recover such residual data. Finally, reverse engineering techniques are explored by exploiting the physical organization and behavior of memory cells. We demonstrate that internal scrambling keys and logical encoding schemes can be reconstructed, thereby enabling the recovery of chip-level information that is inaccessible to normal users. These findings reveal fundamental security weaknesses in 3D NAND flash memory and highlight the need for stronger, security-aware designs in future storage systems.