System and method for detecting malicious software in NVMe over fabrics devices
A system and a method to detect malicious software written to an Ethernet solid-state drive (eSSD). The system includes an Ethernet switch, at least one SSD, and a baseboard management controller (BMC). The Ethernet switch receives write data from a communication network in response to a write command. The at least one SSD receives the write data from the Ethernet switch and stores the received write data. The BMC receives from the at least one SSD the received write data. The BMC determines whether the received write data contains malicious software. The received write data may be contained in a plurality of Ethernet packets in which case the BMC stores the received write data in a scan buffer in an order that is based on an assembled order of the received write data.
1. A system, comprising:
an Ethernet switch to receive write data from a communication network in response to a write command; and
a device to receive the write data in a buffer in an order that is based on an assembled order of the write data, wherein the assembled order is based on logical block addresses (LBAs) associated with the received write data,
wherein the device is configured to scan the write data using the buffer to determine that the write data contains at least one of a) a virus code, or b) a malicious signature.
2. The system of claim 1 , wherein:
the device is configured to periodically update a database of virus signature scans; and
the device is configured to scan the write data based at least on the database of virus signature scans.
3. The system of claim 1 , further comprising at least one solid-state drive (SSD) coupled to the Ethernet switch and to the device, the at least one SSD to receive the write data and store the write data, wherein:
the at least one SSD includes a reset pin; and
in response to the device determining that the write data contains the at least one of a) the virus code, or b) the malicious signature, the device is configured to assert the reset pin of the at least one SSD.
4. The system of claim 3 , wherein:
in response to the device determining that the write data contains the at least one of a) the virus code, or b) the malicious signature, the device is configured to assert the reset pin of the at least one SSD until the at least one SSD is at least one of a) removed from the system or b) power is removed from the at least one SSD.
5. The system of claim 3 , wherein the at least one SSD is coupled to the device through at least one of a) a Peripheral Component Interface Express (PCIe) based communication link or b) a system management bus.
6. The system of claim 3 , wherein the device is configured to perform health monitoring of the at least one SSD.
7. The system of claim 3 , wherein the device is configured to provide operational status information of the at least one SSD.
8. The system of claim 1 , wherein the device is configured to:
log detection of the at least one of a) the virus code, or b) the malicious signature; and
notify a storage administrator of the detection of the at least one of a) the virus code, or b) the malicious signature.
9. The system of claim 1 , wherein the virus code comprises a software virus.
10. The system of claim 1 , wherein:
the write data is contained in a a first Ethernet packet and a second adjacent Ethernet packet; and
the device is configured to detect any malicious signature located on a boundary of the first Ethernet packet and the second Ethernet packet.
11. The system of claim 1 , wherein the SSD comprises an Ethernet SSD (eSSD).
12. A method to detect malicious software, the method comprising:
receiving, by an Ethernet switch, write data from a communication network in response to a write command;
receiving, by a device, the write data in a buffer in an order that is based on an assembled order of the write data, wherein the assembled order is based on logical block addresses (LBAs) associated with the received write data;
scanning, by the device, the write data using the buffer; and
determining, by the device, that the write data contains at least one of a) a virus code, or b) a malicious signature.
13. The method of claim 12 , further comprising:
periodically updating, by the device, a database of virus signature scans; and
scanning, by the device, the write data based at least on the database of virus signature scans.
14. The method of claim 12 , further comprising:
receiving, by at least one solid-state drive (SSD), the write data; and
storing, by the at least one SSD, the write data.
15. The method of claim 14 , wherein the at least one SSD includes a reset pin, the method further comprising asserting, by the device, the reset pin of the at least one SSD.
16. The method of claim 15 , the method further comprising asserting, by the device, the reset pin of the at least one SSD until the at least one SSD is at least one of a) removed from the system or b) power is removed from the at least one SSD; and
asserting the reset pin occurs in response to the device determining that the write data contains the at least one of a) the virus code, or b) the malicious signature.
17. The method of claim 14 , wherein the device is configured to perform health monitoring of the at least one SSD.
18. The method of claim 14 , wherein the device is configured to provide operational status information of the at least one SSD.
19. The method of claim 12 , wherein responsive to the device determining that the write data contains the at least one of a) the virus code, or b) the malicious signature:
logging, by the device, detection of the at least one of a) the virus code, or b) the malicious signature; and
notifying, by the device, a storage administrator of the detection of the at least one of a) the virus code, or b) the malicious signature.
20. The method of claim 12 , wherein the write data is contained in a first Ethernet packet and a second adjacent Ethernet packet, the method further comprising detecting, by the device, any malicious signature located on a boundary of the first Ethernet Packet and the second Ethernet packet.