System and method for providing security protection for FPGA based solid state drives
According to some example embodiments, a method for providing security to a storage device includes receiving, by the storage device, a public key via a network; sending, by the storage device, the received public key and a proposed configuration corresponding to the storage device to a security manager that resides in a control plane of the network; determining, by the security manager, whether the public key received from the storage device matches a private key available to the security manager; downloading, by the security manager, the proposed configuration to the storage device; determining, by the security manager, if the proposed configuration is successfully downloaded to the storage device; operating the storage device according to the downloaded configuration; and granting, by the security manager, a request to lease the storage device operating in the downloaded configuration for a time interval.
1. A method for providing security to a storage device, the method comprising:
receiving, by the storage device, a public key via a network;
sending, by the storage device, the received public key and a proposed configuration corresponding to the storage device to a controller that resides in a control plane of the network;
determining, by the controller, that the public key received from the storage device matches a private key available to the controller;
downloading, by the controller, the proposed configuration to the storage device;
determining, by the controller, that the proposed configuration is successfully downloaded to the storage device;
operating the storage device according to the proposed configuration; and
granting, by the controller, a request to lease the storage device operating in the proposed configuration for a time interval,
wherein the downloading by the controller, further comprising:
downloading, by the controller to the storage device, user specific bitfile and firmware corresponding to the proposed configuration;
determining, by the controller, that the time interval granted to lease the storage device is expired;
issuing, by the controller, based on determining that the time interval granted to lease the storage device is expired, a command to delete the user specific bitfile and firmware downloaded to the storage device;
determining, by the controller, that the user specific bitfile and firmware are successfully deleted from the storage device leased for the time interval; and
determining, by the controller, based on determining that the user specific bitfile and firmware are successfully deleted from the storage device, the storage device is ready to be leased by a new user.
2. The method of claim 1 , wherein the public key is received by the storage device from a host device; wherein the method further comprising:
determining, by the controller, based on determining that the public key received from the storage device matches the private key available to the controller, that the proposed configuration corresponding to the storage device matches with an allowable configuration of the storage device,
wherein the proposed configuration is downloaded based on determining that the proposed configuration corresponding to the storage device matches the allowable configuration of the storage device.
3. The method of claim 2 , wherein the controller determines that the proposed configuration corresponding to the storage device matches the allowable configuration of the storage device using a storage device configuration table available to the controller.
4. The method of claim 3 , wherein the storage device configuration table is a field programmable gate array (FPGA) configuration table available to the controller.
5. The method of claim 2 , wherein based on the controller determining that the public key received from the storage device does not match the private key available to the controller and/or the proposed configuration corresponding to the storage device does not match the allowable configuration of the storage device, the controller terminates a request from the host device to lease the storage device.
6. The method of claim 2 , wherein the storage device is a field programmable gate array (FPGA) solid state drive (SSD), the controller is a baseband management controller (BMC), the host device is an authority server, and the network is Ethernet.
7. A system comprising:
a storage device configured to receive a public key, and send the received public key and a proposed configuration corresponding to the storage device to a controller that resides in a control plane of a network; and
the controller configured to determine that the public key received from the storage device matches a private key available to the controller, and download the proposed configuration to the storage device,
wherein the controller is further configured to:
download user specific bitfile and firmware corresponding to the proposed configuration to the storage device;
determine that a time interval granted to lease the storage device is expired;
issue a command to delete the user specific bitfile and firmware downloaded to the storage device based on determining that the time interval granted to lease the storage device is expired;
determine that the user specific bitfile and firmware are successfully deleted from the storage device leased for the time interval; and
determine that the storage device is ready to be leased by a new user based on determining that the user specific bitfile and firmware are successfully deleted from the storage device.
8. The system of claim 7 , wherein the public key is received by the storage device from a host device and wherein the controller is further configured to grant a request from one or more users via the host device to lease the storage device operating in the proposed configuration for the time interval.
9. The system of claim 8 , wherein the storage device is a field programmable gate array (FPGA) solid state drive (SSD), the controller is a baseband management controller (BMC), the host device is an authority server, and the network is Ethernet.
10. The system of claim 7 , the controller is further configured to determine, based on determining that the public key received from the storage device matches the private key available to the controller, that the proposed configuration corresponding to the storage device matches with an allowable configuration of the storage device,
wherein the proposed configuration is downloaded based on determining that the proposed configuration corresponding to the storage device matches the allowable configuration of the storage device.
11. The system of claim 10 , wherein the controller determines that the proposed configuration corresponding to the storage device matches the allowable configuration of the storage device using a storage device configuration table available to the controller.
12. The system of claim 11 , wherein the storage device configuration table is a field programmable gate array (FPGA) configuration table available to the controller.
13. The system of claim 10 , wherein based on the controller determining that the public key received from the storage device does not match the private key available to the controller and/or the proposed configuration corresponding to the storage device does not match the allowable configuration of the storage device, the controller terminates a request to lease the storage device.