In-Depth

Eat the WORM: First Realtime Tests Help Determine Security of Data Stored on WORM Media

• By Robert Longman, John Drollinger
• 12/01/2000

Many industries, such as securities, insurance, government and nuclear power, require extraordinary measures to safeguard computer-generated data. The majority of these companies have settled on optical write-once-read-many (TrueWORM) technology as today’s most secure storage solution with a minimum life of several decades. But, there are a number of users with critical applications that want to know more specifically how long WORM media will last. Up to now, this technology simply hasn’t been around long enough to even take a stab at answering this question based on realtime testing, making it necessary to rely on accelerated aging tests and other theoretical projections. The accuracy of these methods has been demonstrated in a wide range of applications, but, like any projections, they leave room for some small level of doubt. Recently the maturity of optical WORM technology has reached the point where it has finally become possible to test media that was written a considerable period of time in the past. The results indicate that TrueWORM media should have no difficulty lasting the 100 years or so that has been projected in the accelerated aging tests.

Magnetic storage methods, such as disk drives and tape cartridges, have gained the lion’s share of the storage market because of their low cost and rapidly increasing capacity. However, there are still a wide range of applications in which the ability of magnetic storage media to be easily altered and the relatively short life of magnetic media present serious disadvantages. Hard drive producers rate their product life at three to five years, while tape has a seven-to-10 year data life rating in office environments. Of course, the ease of editing magnetic media provides little or no assurance that the retrieved document is identical to the original. Many organizations are required, either by law or for business reasons, to maintain their records for a considerably longer period of time. A large number of these organizations have implemented optical TrueWORM storage systems because of their ability to provide far longer media life, as well as much greater security against malicious or unintentional editing.

Operation of Optical Drives

All optical drives use a laser beam to bounce off a shiny disk, and hit a receptor. The laser momentarily raises the temperature of the recording surface by hundreds of degrees during the write process. Altering the original data in a WORM recording layer is absolutely impossible, as the recording process is irreversible. In any recording layer, the data can be made unreadable by writing additional marks in the spaces between the original marks; however, in a well-designed WORM-drive, accidental or intentional over-writing is prevented by either hard-coded firmware or electrical circuits.

Additional protection of stored data is provided by WORM drives, which contain a series of safeguards. The drives are programmed to recognize codes that are physically stamped onto the disks at the time they are produced, and cannot be altered. If a corrupt data sector on the media is identified, the drive automatically sets aside the bad sector, and doesn’t allow future reads or writes in that area. The data is then sent to a clean, unwritten sector on the disk.

While there are a number of different optical WORM recording technologies, the two most popular are ablative and phase change. Both ablative and phase change optical recording use the same basic principle of writing data to a disk by locally changing the reflectance of a recording layer. A recording layer may be a single thin film alloy, or it may be a stack of several thin film alloys deposited on top of each other.

Ablative Process

With ablative technology, the recording layer is in a crystalline state. A laser is focused to a spot and heats the material, normally Tellurium alloy, in the recording layer to above its melting point. The forces from the heat cause the molten material to roll back from a central point, resulting in a hole with a rim or a small crater. The rim material first has a darker amorphous state, but returns within a few days to its original brighter crystalline state. Re-heating the area around the hole never results in back-filling the hole. The end result is a dark hole or pit with a much brighter rim and surrounding surface area. This contrast is easily detected by the laser on its read-pass, and is the basis for recording and reading digital data.

Phase Change Process

With the phase change process, the unrecorded media is in the amorphous state. During writing, the layer is locally heated to a temperature at which it changes to a crystalline state, thus creating permanent crystalline data marks with a different reflectance than the surrounding amorphous area. The phase change takes place by a two-step process: a nucleation step, followed by a growth step. Each process occurs at a characteristic temperature and time-scale and is, therefore, very repeatable. On a sub-microsecond scale the temperatures are in the region of 200 degrees C to 400 degrees C.

The phase change layer has no unstable intermediate state like in the ablative Tellurium alloy, which greatly simplifies the data-verify pass for drives using the phase change technology. Phase change alloys similar to those used for WORM media can also be used to produce a rewritable version, however, phase change media designed for WORM recording cannot be edited.

The Tellurium alloy used in ablative products is particularly susceptible to corrosion, and the sensitive layer is, therefore, protected from the atmosphere by a hermetically-sealed air sandwich design. As a result, quality and reliability of the disk-seal are the dominant factors affecting the resistance of the ablative disks to corrosion. Most phase change media, on the other hand, show remarkable resistance to corrosion with accelerated life tests, indicating that it will be hundreds of years before degradation of the recorded data is seen.

Construction Options

The ablation process requires a sealed air-sandwich construction. The constant pressure inside such a sealed disk causes the disk-shape to vary between concave, flat and convex when the disk is used over a range of altitudes, resulting in undesirable tilt-variations. Tilt is a major contributor to optical aberrations; hence, a sealed air-sandwich has limited altitude specifications. Even within these specifications, the read/write margins are reduced due to the small tilt-variations.

With phase-change media there are more options for the disk-construction, all with unlimited altitude specifications. Construction could include a non-sealed air-sandwich, a single-sided disk with a protective lacquer, two disk-sides glued back to back or a laminated disk with two disk-sides glued to a spacer. Current ablative media uses a Tellurium layer that is not suitable for multilayer recording. Phase change technology opens the door for multilayer recording in future products that can enable much higher data densities simply due to the potential for recording on multiple layers.

Designed for Long Life

Both major types of optical WORM disks are designed for a phenomenally long life. Samples have been studied and exposed to a Battelle nominal chloride/H2S, NO2 environment for 30 days, and a self protecting layer of 4nm was observed to grow. The conclusion was that, under normal conditions, the lifetime of the product due to corrosion is at least 30 years for a fully-exposed surface. In fact, the venting of the media is very slight so that very little ingress of atmospheric pollutants is likely to access the disk surfaces; hence, one can expect a much longer life expectancy associated with this effect.

The film used in the optical disk has been shown to be exceedingly stable under all circumstances, and the material is unlikely to transform in a time period less than 1,000 years under normal storage conditions. The actual estimate made from existing data is 1,030 years. Various measures have been made of this effect. For instance, it has been observed that after six hours at 140 degrees C marks are seen to grow slightly, but also get "brighter" so that written data is improved with this aging. It is only after an estimated 30 hours at this temperature that any loss of data quality has been observed. From these estimates the life of the product at a temperature 30 degrees C is in excess of 100 years.

It has been observed that write characteristics improve with time at elevated temperature; thus, after heating at 120 degrees C for 10 hours, the signal amplitudes are increased by at least 15 percent, and after a further 30 hours, there is a further increase of 15 percent in signal amplitude. The write margin for data written on the disk where the write margin is lowest is increased by as much as 60 percent due to this improvement of signal amplitude. The optical properties of these amorphous layers have been observed to be very stable, with the reflectivity changing less than 0.2 percent over a period of 15 hours heating at 140 degrees C.

Accelerated Aging Tests

For all of these reasons, there is general agreement that the life of optical worm media is far longer than magnetic, a minimum of several decades. But, users with the most critical data security have the need to know more precisely how long optical media will last. The standard method for predicting the failure of a very long-lived product is the Arrhenius Model, a set of mathematical procedures and computations for accelerated aging.

The Arrhenius Model assumes that the temperature and relative humidity are the crucial independent variables that over time affect the longevity of optical media. The National Institute of Standards and Technology has developed a methodology that involves storing optical disks in three different high-stress environments – 70 degrees C, 80 degrees C and 90 degrees C – with a constant relative humidity of 90 percent for an extended period of time. The disks are read periodically to monitor the effect of temperature and humidity on the error rate. Comparing effect on the error rate of the different stress environments makes it possible to extrapolate the error rates at nominal room temperatures. The end-of-life definition is typically five bytes of out every 10,000 bytes, which is well within the capacity of most error-checking codes.

Realtime Aging Tests

Today, we have finally reached the time period at which optical WORM recordings that have been made a considerable time period ago can be tested. Plasmon scientists have optical media in their archives that was manufactured and written 13 years ago. They took new media, and wrote the same data on it.

The test involved use of an atomic force microscope (AFM) to examine the surfaces of the two platters. The AFM works by scanning a fine ceramic or semiconductor tip over a surface, much the same way a phonograph needle scans a record. The tip is positioned at the end of a cantilever beam shaped much like a diving board. As the tip is repelled by or attracted to the surface, the cantilever beam deflects. The magnitude of the deflection is captured by a laser that reflects at an oblique angle from the very end of the cantilever. A plot of the laser deflection versus tip position on the sample surface provides the resolution of the hills and valleys that constitute the topography of the surface.

Various test results cleary show that optical WORM media have the longevity, and the removability required for the most demanding data storage applications. The tests that show 13-year-old media performing equivalent to new media are consistent with a projected life of 100 years. WORM technologies are accepted by the Security & Exchange Commission, and recognized by the court system. Combined with a strong physical security process, they offer a secure, long-term storage strategy that virtually eliminates the possibility of data loss.

About the Authors: