Validating firmware for data storage devices
This disclosure relates to a storage device comprising non-volatile storage and a controller. The non-volatile storage may comprise a firmware image, a known data pattern (KDP) in plaintext, and an encrypted KDP. The controller may be coupled to the non-volatile storage, and may be configured to update the firmware image of the non-volatile storage. For this update, the controller may first receive a symmetric key from a host by way of a public key encryption process. Next, the controller may decrypt the encrypted KDP using the symmetric key. If the decrypted KDP matches the KDP in plaintext, the symmetric key may be validated and the firmware image update may be downloaded. The firmware image update may then replace the firmware image in non-volatile storage.
1. A storage device comprising:
non-volatile storage comprising:
a firmware image configured to operate the storage device;
a known data pattern (KDP) in plaintext;
an encrypted KDP, wherein the encrypted KDP is encrypted using a symmetric key;
a public key; and
a private key exclusive to the storage device; and
a controller coupled to the non-volatile storage, wherein the controller is configured to:
send, to a requesting host, the public key to initiate a firmware image update;
receive, from the requesting host and in connection with the firmware image update, an encrypted symmetric key, wherein the encrypted symmetric key is encrypted by the requesting host using the sent public key;
decrypt, using the private key, the encrypted symmetric key to generate a received decrypted symmetric key;
decrypt the encrypted KDP using the received decrypted symmetric key to create a decrypted KDP;
validate the received decrypted symmetric key in response to the decrypted KDP matching the KDP in plaintext;
download, from the requesting host, the firmware image update in response to the controller validating the received decrypted symmetric key;
replace, in the non-volatile storage, the firmware image with the firmware image update; and
boot, during a subsequent booting event, the firmware image update to operate the storage device.
2. The storage device of claim 1 , wherein the encrypted KDP and KDP in plaintext are stored in the non-volatile storage by an Original Equipment Manufacturer (OEM) of the storage device.
3. The storage device of claim 1 , wherein:
the requesting host encrypted, prior to download of the firmware image update by the storage device, the firmware image update using the symmetric key; and
the controller is further configured to decrypt, prior to replacing the firmware image with the firmware image update, the firmware image update using the symmetric key.
4. The storage device of claim 1 , wherein:
the firmware image update comprises a verification data pattern configured to shift a firmware image layout to obfuscate the firmware image; and
the controller is further configured to:
recognize the verification data pattern in the firmware image update; and
access the firmware image update according to the firmware image layout.
5. The storage device of claim 4 , further comprising a bootloader configured to only boot the storage device in response to the firmware image layout satisfying the recognized verification data pattern.
6. The storage device of claim 5 , wherein the bootloader is configured to boot a second firmware image in response to the firmware image layout failing to satisfy the recognized verification data pattern.
7. The storage device of claim 1 , wherein:
the public key is uniquely associated with the storage device; and
the requesting host generated, prior to sending the encrypted symmetric key, the encrypted symmetric key using the public key.
8. The storage device of claim 1 , wherein the controller is further configured to reject a firmware image update prompt from the requesting host in response to the decrypted KDP not matching the known data pattern in plaintext.
9. The storage device of claim 1 , wherein the non-volatile storage comprises embedded non-volatile memory and one or more storage media.
10. The storage device of claim 1 , wherein the symmetric key comprises an Advanced Encryption Standard (AES) key having at least 256 bits.
11. A storage device bridge comprising: a storage bus coupled to one or more storage media; embedded non-volatile memory comprising: a firmware image; a known data pattern (KDP); an encrypted KDP, wherein the encrypted KDP is encrypted using a symmetric key; a private key; and a public key;
means for sending, to a requesting host, the public key to initiate a firmware image update, means for receiving, from the requesting host and over a secure communication channel, an encrypted symmetric key, wherein the encrypted symmetric key is encrypted by the requesting host using the sent public key, and the firmware image update is encrypted using the symmetric key;
means for decrypting, using the private key, the encrypted symmetric key to generate a received decrypted symmetric key;
means for decrypting the encrypted KDP using the received decrypted symmetric key and validating the received decrypted symmetric key in response to the decrypted KDP matching the known data pattern;
means for downloading and decrypting the firmware image update in response to validating the received decrypted symmetric key;
means for replacing the firmware image with the firmware image update, and
means for booting, during a subsequent booting event, the firmware image update.
12. The storage device bridge of claim 11 , wherein:
the host the public key is uniquely associated with the storage device bridge; and
the encrypted symmetric key is encrypted by the requesting host using the public key.
13. The storage device bridge of claim 11 , wherein the encrypted KDP and KDP are stored in the embedded non-volatile memory during manufacture of the storage device bridge.
14. The storage device bridge of claim 11 , wherein:
the firmware image update comprises a verification data pattern configured to obfuscate the firmware image update; and
the means for booting the firmware image update in the storage device bridge is in response to a firmware image layout of the firmware image update satisfying a recognized verification data pattern.
15. The storage device bridge of claim 14 , wherein the means for booting the firmware image update in the storage device bridge is configured to boot a second firmware image in response to the firmware image layout failing to satisfy the recognized verification data pattern.
16. The storage device bridge of claim 11 , wherein the means for downloading and decrypting the firmware image update is configured to reject a firmware image update prompt from the requesting host in response to the decrypted KDP not matching the known data pattern.
17. The storage device bridge of claim 11 , wherein the symmetric key comprises an Advanced Encryption Standard (AES) key having at least 256 bits.
18. A method comprising: manufacturing a storage device comprising: a known data pattern (KDP); an encrypted KDP, wherein the encrypted KDP is encrypted using an Advanced Encryption Standard (AES) key; a firmware image; and, a public key; generating a firmware image update;
encrypting the firmware image update using the AES key;
based on request from storage device, receiving the public key from the storage device to initiate a firmware image update download;
encrypting the AES key using the received public key;
sending the encrypted AES key to the storage device, wherein the storage device is configured to: decrypt the AES key using a private key exclusive to the storage device to generate a received AES key;
decrypt, using the received decrypted AES key, the encrypted KDP; and
to validate the received decrypted AES key by comparing the decrypted KDP to the KDP in the storage device; and
sending the firmware image update to the storage device by: dividing the firmware image update into packets; and
sending each packet to the storage device, wherein the storage device is further configured to: decrypt each packet of the firmware image update using the decrypted AES key;
store each decrypted packet in non-volatile, storage of the storage device; and
boot the firmware image update during a subsequent booting event.
19. The method of claim 18 , further comprising:
receiving, by the storage device, a second known data pattern in response to completing a download of the firmware image update; and
replacing, by the storage device, the known data pattern with the second known data pattern.
20. The method of claim 18 , further comprising:
receiving, by the storage device, a second verification data pattern in response to completing a download of the firmware image update; and
replacing, by the storage device, a recognized verification data pattern with the second verification data pattern.