Detection of compromised storage device firmware
An apparatus, system, and method for detecting compromised firmware in a non-volatile storage device. A control bus of a non-volatile storage device is monitored. The non-volatile storage device includes a processor and electronic components coupled to the control bus. Signal traffic on the control bus is analyzed for events and/or triggers related to storage operations initiated on the control bus by the processor. Storage operations include one or more commands directed to at least one of the electronic components. If the latency for the storage operation satisfies an alert threshold a host is notified of compromised firmware.
1. A system, comprising:
a non-volatile memory array configured to store data in memory cells thereof; and
a storage controller comprising:
a security chip configured to monitor signal traffic on an internal communication bus to detect anomalies indicative of a compromised storage controller firmware image, wherein the security chip comprises a detector that is configured to:
perform a predictable storage operation check to determine whether or not storage operations received are predictable storage operations;
review predictable storage operations with a threshold checker;
gather latency data with an anomaly detector and mark unpredictable storage operations as semi-predictable storage operations; and
register an alert;
a host interface manager coupled to an external communication bus and configured to communicate between the host and the storage controller and to maintain a secure communication channel between the host and the security chip; and
a memory interface manager coupled to the internal communication bus and to an external communication bus coupled to the non-volatile memory array for reading and writing data to the non-volatile memory array.
2. The system of claim 1 , wherein the storage controller further comprises a storage processor coupled to the internal communication bus.
3. The system of claim 1 , wherein the storage controller further comprises volatile memory coupled to the internal communication bus and configured to store a storage controller firmware image.
4. The system of claim 1 , wherein the storage controller further comprises an error correcting code (ECC) manager coupled to the internal communication bus and configured to encode and decode data stored on, and retrieved from, the non-volatile memory array.
5. The system of claim 1 , wherein the controller further comprises a direct memory access (DMA) manager coupled to the internal communication bus and configured to transfer data between a host and the storage controller.
6. The system of claim 1 , wherein the storage controller further comprises a flash translation manager coupled to the internal communication bus and configured to translate a logical block address into a physical block address within the non-volatile memory array and manage caching of an address mapping table.
7. The system of claim 1 , wherein the storage controller further comprises a host memory buffer manager coupled to the internal communication bus and configured to manage a host memory buffer within volatile memory of the host.
8. The system of claim 1 , wherein the security chip is a separate component on a printed circuit board that comprises a storage processor and volatile memory and the internal communication bus is configured such that the storage processor cannot communicate with the security chip.
9. The system of claim 1 , further comprises a secure communication channel connecting the security chip to the host.
10. The system of claim 1 , wherein the host comprises one of a security circuit and a computing device external to the system.
11. The system of claim 1 , wherein the storage controller further comprises volatile memory.
12. The system of claim 11 , wherein the volatile memory comprises a flash translation manager.
13. The system of claim 12 , wherein the flash translation manager is coupled to the internal communication bus.
14. The system of claim 12 , wherein the non-volatile memory array comprises a storage controller firmware image.
15. The system of claim 14 , wherein the non-volatile memory array comprises a host memory buffer manager.
16. The system of claim 1 , wherein the security chip comprises:
a communication module;
a processor; and
memory, wherein the memory comprises non-volatile memory and volatile memory.
17. A system, comprising:
a non-volatile memory array configured to store data in memory cells thereof; and a storage controller comprising:
an internal communication bus;
a storage processor coupled to the internal communication bus;
volatile memory coupled to the internal communication bus and configured to store a storage controller firmware image;
an error correcting code (ECC) manager coupled to the internal communication bus and configured to encode and decode data stored on, and retrieved from, the non-volatile memory array;
a direct memory access (DMA) manager coupled to the internal communication bus and configured to transfer data between a host and the storage controller;
a flash translation manager coupled to the internal communication bus and configured to translate a logical block address into a physical block address within the non-volatile memory array and manage caching of an address mapping table;
a host memory buffer manager coupled to the internal communication bus and configured to manage a host memory buffer within volatile memory of the host; and
a security chip coupled to the internal communication bus and configured to monitor signal traffic on the internal communication bus to detect anomalies indicative of a compromised storage controller firmware image, wherein the security chip comprises a detector that is configured to:
perform a predictable storage operation check to determine whether or not storage operations received are predictable storage operations;
review predictable storage operations with a threshold checker;
gather latency data with an anomaly detector and mark unpredictable storage operations as semi-predictable storage operations; and
register an alert;
a host interface manager coupled to an external communication bus and configured to communicate between the host and the storage controller and to maintain a secure communication channel between the host and the security chip; and
a memory interface manager coupled to the internal communication bus and to an external communication bus coupled to the non-volatile memory array for reading and writing data to the non-volatile memory array.
18. The system of claim 17 , wherein the storage controller further comprises a flash translation manager coupled to the internal communication bus and configured to translate a logical block address into a physical block address within the non-volatile memory array and manage caching of an address mapping table.
19. The system of claim 17 , wherein the storage controller further comprises a host memory buffer manager coupled to the internal communication bus and configured to manage a host memory buffer within volatile memory of the host.
20. The system of claim 17 , wherein the security chip is a separate component on a printed circuit board that comprises a storage processor and volatile memory and the internal communication bus is configured such that the storage processor cannot communicate with the security chip.