Detection of compromised storage device firmware

Patent metadata

Field	Value
Publication number	US-2021390179-A1
Application number	US-202016901633-A
Country	US
Kind code	A1
Filing date	Jun 15, 2020
Priority date	Jun 15, 2020
Publication date	Dec 16, 2021
Grant date	—

Abstract

An apparatus, system, and method for detecting compromised firmware in a non-volatile storage device. A control bus of a non-volatile storage device is monitored. The non-volatile storage device includes a processor and electronic components coupled to the control bus. Signal traffic on the control bus is analyzed for events and/or triggers related to storage operations initiated on the control bus by the processor. Storage operations include one or more commands directed to at least one of the electronic components. If the latency for the storage operation satisfies an alert threshold a host is notified of compromised firmware.

First claim

What is claimed is:

1 . A method, comprising:
monitoring a control bus of a non-volatile storage device comprising a processor coupled to the control bus and a plurality of electronic components each coupled to the control bus; analyzing signal traffic on the control bus for events for a storage operation initiated on the control bus by the processor, the storage operation comprising one or more commands directed to at least one of the plurality of electronic components; measuring a latency for the storage operation; determining that the latency for the storage operation satisfies an alert threshold; and notifying a host of a compromised firmware in response to the storage operation satisfying the alert threshold.

2 . The method of claim 1 , wherein detecting the storage operation comprises:
monitoring signal traffic between the processor and one or more of the plurality of electronic components; determining that the signal traffic is associated with a target storage operation; and identifying a start event for the target storage operation; and identifying a stop event for the target storage operation.

3 . The method of claim 2 , wherein measuring the latency further comprises measuring a time interval between the start event and the stop event and designating the time interval as the latency for the target storage operation, the method further comprising storing the latency for the target storage operation.

4 . The method of claim 1 , further comprising receiving a firmware monitoring request from the host at a security chip coupled to the control bus, the security chip operating independent of the processor and independent of firmware executing on the processor, the security chip configured to notify the host of compromised firmware based on one or more target storage operations.

5 . The method of claim 4 , wherein in response to receiving the firmware monitoring request, establishing a secure communication channel between the security chip and the host, the secure communication channel configured to be inaccessible to the firmware executing on the processor.

6 . The method of claim 4 , wherein the firmware monitoring request designates one or more storage operations as target storage operations.

7 . The method of claim 1 , wherein determining further comprises:
determining that the latency of the storage operation comprises an anomaly in response to the latency satisfying an alert threshold for the storage operation and the storage operation comprises a predictable storage operation; and determining that the latency of the storage operation comprises an anomaly in response to the latency satisfying an anomaly detector for the storage operation and the storage operation comprises a semi-predictable storage operation.

8 . The method of claim 7 , wherein the anomaly detector comprises logic that implements one of:
a Support-Vector-Machine (SVM) linear variant method; a Gaussian-Mixture-Model (GMM) method; a density-based variant detection method; a replicator neural network; a cluster-based variant detection method; and a K-means detection method.

9 . An apparatus, comprising:
a communication bus; a memory coupled to the communication bus, the memory configured to store a storage security firmware image, an alert threshold, and a repository comprising latency data; a processor coupled to the communication bus, the processor configured to execute the storage security firmware image comprising:
a monitor configured to generate latency data for a target storage operation, the target storage operation identified based on signal traffic on the communication bus;
a detector configured to determine an anomaly based on the latency data for the target storage operation; and
a reporter configured to signal a host in response to the detector identifying the anomaly indicating a compromised storage controller firmware image; and
a communication module coupled to the communication bus and configured to communicate the anomaly to the host.

10 . The apparatus of claim 9 , wherein the monitor comprises:
an analyzer configured to detect events in signal traffic traveling over the communication bus based on a trigger, the events characteristic of the target storage operation; a tracker configured to measure a time interval between a start event and a stop event, the start event and stop event distinctively associated with the target storage operation.

11 . The apparatus of claim 9 , wherein the communication module comprises a security module configured to establish a secure communication channel between the host and the communication module.

12 . The apparatus of claim 9 , wherein the target storage operation comprises one of a flash logical block address translation operation, a firmware initialization operation, a host memory buffer initialization operation, a host memory buffer release operation, a power down operation, and a power on reset operation.

13 . The apparatus of claim 9 , wherein the anomaly is indicative of the compromised storage controller firmware image.

14 . The apparatus of claim 9 , wherein the detector comprises an anomaly detector configured to:
analyze a set of latency data over a historical time period; tune the anomaly detector based on the analyzed set of latency data; determine that the target storage operation comprises a semi-predictable storage operation; determine that the latency data for the target storage operation indicates the anomaly; and log the anomaly and the latency data.

15 . The apparatus of claim 9 , wherein the communication module is configured to communicate exclusively with the host.

16 . The apparatus of claim 9 , wherein the target storage operation is initiated by a storage processor coupled to the communication bus and the communication module couples to the communication bus such that no communication channel exists between the communication module and the storage processor.

17 . A system, comprising:
a non-volatile memory array configured to store data in memory cells thereof; and a storage controller comprising:
an internal communication bus;
a storage processor coupled to the internal communication bus;
volatile memory coupled to the internal communication bus and configured to store a storage controller firmware image;
an error correcting code (ECC) manager coupled to the internal communication bus and configured to encode and decode data stored on, and retrieved from, the non-volatile memory array;
a direct memory access (DMA) manager coupled to the internal communication bus and configured to transfer data between a host and the storage controller;
a flash translation manager coupled to the internal communication bus and configured to translate a logical block address into a physical block address within the non-volatile memory array and manage caching of an address mapping table;
a host memory buffer manager coupled to the internal communication bus and configured to manage a host memory buffer within volatile memory of the host; and
a security chip coupled to the internal communication bus and configured to monitor signal traffic on the internal communication bus to detect anomalies indicative of a compromised storage controller firmware image;
a host interface manager coupled to an external communication bus and configured to communicate between the host and the storage controller and to maintain a secure communication channel between the host and the security chip; and a memory interface manager coupled to the internal communication bu

Assignees

• Western Digital Tech Inc

Inventors

• Hahn Judah Gamliel
• Benisty Shay
• Navon Ariel

Classifications

• G06F2212/7208

  Multiple device management, e.g. distributing data over multiple flash devices · CPC title

• G06F2212/7201

  Logical to physical mapping or translation of blocks or pages · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F2212/1024

  Latency reduction · CPC title

• G06F13/28 Primary

  using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence) · CPC title