Application of EN18031 Deletion Mechanism (DLM) in 4G Wireless Routers

EN 18031 Deletion Mechanism (DLM) Overview

The Deletion Mechanism (DLM) is a critical security function designed to ensure that personal data and sensitive security parameters stored on radio equipment can be deleted by the user, thereby preventing the risk of data leakage during equipment disposal or replacement.

The Deletion Mechanism (DLM) is a key security requirement defined in the European Standard EN 18031-2:2024, aiming to enhance the protection capabilities of radio equipment for network and privacy assets. It applies to internet-connected radio equipment and radio equipment processing personal data, traffic data, or location data, while also covering network equipment. Therefore, as an internet-connected radio equipment and network equipment, the 4G wireless router’s deletion mechanism should comply with DLM requirements.

▶ Application of Deletion Mechanism (DLM) in 4G Wireless Routers

1. Applicability of Deletion Mechanism (DLM)

Requirement: The equipment shall provide a deletion mechanism that allows a user to delete their personal data and sensitive security parameters stored on the equipment.

Rationale: This requirement is introduced to prevent the risk of personal data being exposed when the equipment is disposed of or replaced. If the integrity of the stored security assets or privacy assets is not appropriately protected, an attacker might manipulate these assets, which could lead to violations of personal rights, such as misuse of personal information, false attribution, etc.

Guidance：

User Role: Generally, a user can delete their own personal data. If there are multiple users, a user with administrator rights can delete data of all users. An authorized user can delete personal data to which they have access.
Mechanism Characteristics: The deletion mechanism should possess the following characteristics:
Interruption Resistance: It should be resilient, capable of resuming and completing the deletion operation after an interruption.
Tamper Resistance: It should be resistant to tampering, such as unauthorized deletion attempts or attempts to prevent authorized deletion.
Prevention of Accidental Triggering: It should protect users from accidental deletion.
Special Authorization Circumstances: In some cases, an authorized entity (e.g., an entity with supervisory responsibility or the equipment owner) might be required to initiate or approve deletion operations, especially when data is critical to operation (e.g., in industrial environments).

2. DLM Application in 4G Wireless Router Products

① Data Types Requiring Deletion：

Personal Data: This includes any information set by the user in the router, such as：

Wi-Fi network name (SSID) and password.
List of connected device names, MAC addresses, and IP addresses.
Possible browsing history (if the router has logging or parental control functions).
VPN configuration information, port forwarding rules, etc.
The device’s own geolocation data (if the router supports such functionality and collects it).

Sensitive Security Parameters：

The router’s administrator password.
Cryptographic keys or certificates used for secure communication of the equipment (e.g., firmware updates, remote management, VPN connections).
Internal security keys used by the equipment to protect data integrity and confidentiality.

② DLM Implementation Methods：

Factory Reset: For 4G wireless routers, the most common DLM implementation is to provide a “reset to factory settings” function. This function should ensure that all user-stored personal data and sensitive security parameters are securely and permanently erased, making them unrecoverable.
Secure Erase: When performing a factory reset, the router should use secure erase techniques, for instance, by deleting the encryption key and generating a new one to ensure old data cannot be recovered. Simple formatting or file deletion may not be sufficient to meet the standard of “permanently unrecoverable”.
User-friendliness: The deletion mechanism should be easy for users to operate, for example, by triggering it via a physical button (usually requiring a long press) or a clear option in the management interface. Simultaneously, there should be clear prompts and confirmation steps to prevent accidental data deletion by the user.
Interruption Resistance and Tamper Resistance: During the deletion process, the router should be designed to resume and complete deletion even if power is interrupted, and to prevent malicious software or unauthorized users from tampering with the deletion process.

③ Documentation and Compliance：

The manufacturer needs to provide detailed documentation explaining what personal data and sensitive security parameters the 4G wireless router stores.
The documentation must also detail how the deletion mechanism works, including its resilience, tamper resistance, and operation instructions.
The manufacturer must be able to demonstrate through assessment that its product conceptually and functionally meets the DLM requirements, meaning data can be effectively and securely deleted.

3. Deletion Mechanism (DLM) and Its Interaction with Other Security Mechanisms

In 4G wireless router products, the Deletion Mechanism (DLM) interacts with various other security mechanisms to ensure that personal data and sensitive security parameters can be securely and unrecoverably deleted, thereby preventing data leakage risks.

① Secure Storage Mechanism (SSM)

Core Link: The primary purpose of DLM is to delete personal data and sensitive security parameters persistently stored on the device. This directly relates to the responsibility of SSM, which is to protect the persistent storage of these assets.
Deletion Effectiveness: DLM guidance explicitly states that “delete” means making personal information “permanently unrecoverable,” which requires resetting the device to factory settings and securely erasing and generating a new encryption key. This mandates that SSM stores data in a way that supports such secure erasure, and can work in conjunction with Confidential Cryptographic Keys (CCK) when deletion is required.

② Confidential Cryptographic Keys (CCK)

Key Management: As mentioned, the effective execution of DLM involves securely erasing encryption keys and generating new ones to ensure data unrecoverability. CCK mechanisms (such as CCK-1 and CCK-2) are responsible for ensuring that the generation of these keys adheres to best practice cryptography standards and possesses sufficient security strength. If the encryption keys themselves are not securely managed and deleted, even if data appears “deleted“, attackers might still recover data using old keys.

③ Access Control Mechanism (ACM)

Permission Management: DLM guidance emphasizes that users can typically delete their own data, while users with administrator rights can delete all user data. ACM (such as ACM-1 and ACM-2) is precisely used to manage entities’ access rights to security assets and privacy assets. ACM ensures that only authorized entities can access protected assets, thereby also ensuring that only authorized users can trigger the deletion mechanism or change its settings.
Prevention of Accidental Triggering: The DLM mechanism should “prevent unintentional triggering“. ACM plays a crucial role here by limiting who can access the deletion function and how, thus preventing unauthorized or accidental deletion operations.

④ Authentication Mechanism (AUM)

Identity Verification: Before an authorized user can trigger DLM via ACM, they must first be authenticated via AUM. AUM (such as AUM-1 and AUM-2) aims to verify the identity of entities. This ensures that only verified, legitimate users can access deletion functions. For instance, AUM-2-2 even requires two-factor authentication for devices processing personal information of special categories, providing higher security for deleting sensitive data.

⑤ Logging Mechanism (LGM)

Audit Trail: LGM-1 explicitly requires equipment to log internal activities relevant to privacy assets and their protection. Deleting personal data and sensitive security parameters are highly relevant privacy protection events, so DLM operations should be recorded by LGM. Logs can provide information to help identify abnormal behavior or data breaches, including “deletion of important data files“.
Conflict Handling: The Logging mechanism (LGM) requires recording “internal activities relevant to privacy assets and their protection (events)“, so deletion mechanism (DLM) activities should be recorded, while deletion mechanism (DLM) should delete logs or make them unrecoverable. WiseWIsh Technology’s 4G wireless router products handle this conflict in an elegant way.

⑥ User Notification Mechanism (UNM)

User Transparency: UNM-1 requires the equipment to notify the user of changes affecting the protection or privacy of personal information. While deletion operations are usually initiated by the user, if the deletion mechanism’s policy or functionality changes, or if confirmation of the deletion operation’s completion is needed, UNM must function to ensure the user is aware of these critical details.

⑦ General Equipment Capabilities (GEC)

Security Infrastructure: GEC includes multiple general capabilities that provide the foundation for the reliable operation of DLM. For example:
GEC-1 (Up-to-date software and hardware): Ensures that the DLM’s software and hardware implementation has no publicly known exploitable vulnerabilities, thereby preventing attackers from exploiting these vulnerabilities to bypass or compromise the deletion mechanism.
GEC-6 (Input validation): Ensures that all inputs received by DLM are validated to prevent injection attacks or other malicious inputs from leading to unexpected behavior or vulnerabilities.

In conclusion, DLM does not operate in isolation; it is closely integrated with the router’s storage, key management, access control, authentication, logging, and general security functions. These mechanisms work together to ensure that personal data and sensitive security parameters on 4G wireless routers can be deleted securely, effectively, and auditable at the end of their lifecycle or when no longer needed.