Securing a data storage device against rogue hosts
A method for securing a data storage device (DSD) against rogue behaviour by a host, the method executed by a controller of the DSD and comprising: determining a host type of the host; detecting one or more access activities performed by the host on the DSD; processing the one or more access activities to determine a security threat level of the host, wherein the security threat level is determined by weighting one or more corresponding access activity parameters by one or more impact weights; and in response to determining that the security threat level of the host is greater than or equal to a rogue host threat level, controlling the access activities performable by the host on the DSD to safeguard the DSD against the host, wherein the one or more impact weights are dynamically determined based on the host type.
1. A method for securing a data storage device (DSD) against rogue behaviour by a host, the method executed by a controller of the DSD and comprising:
determining a host type of the host;
detecting one or more access activities performed by the host on the DSD;
processing the one or more access activities to determine an observed activity criteria matrix comprised of activity values for the one or more access activities;
retrieving an expected activity criteria matrix comprised of expected values for host behaviour;
determining a set of access activity parameters indicating deviations of the observed activity criteria matrix from the expected activity criteria matrix;
determining a security threat level of the host by weighting one or more corresponding access activity parameters from the set of access activity parameters by one or more impact weights; and
in response to determining that the security threat level of the host is greater than or equal to a rogue host threat level, controlling the access activities performable by the host on the DSD to safeguard the DSD against the host, wherein the one or more impact weights are dynamically determined based on the host type.
2. The method of claim 1 , wherein the expected activity criteria matrix comprises parameters of an access activity model determined during a training operation for expected access activity of the host type.
3. The method of claim 1 , wherein the rogue host threat level is a numerical threshold value determined, at least in part, based on the host type.
4. The method of claim 3 , wherein the access activities comprise any one or more of:
requesting to read data from, or write data to, a storage medium of the DSD;
requesting access to one or more logical region blocks of the storage medium of the DSD; and
receiving data from, or transmitting data to, a data path of the DSD.
5. The method of claim 1 , wherein:
the observed activity criteria matrix and the expected activity criteria matrix each comprise a matrix of a number of activity patterns by a number of criteria comprising each activity pattern; and
determining the set of access activity parameters comprises calculating the access activity parameter as a normalized numeric value based on comparison of corresponding elements from the observed activity criteria matrix and the expected activity criteria matrix.
6. The method of claim 5 , wherein the activity values of the one or more access activities for an activity pattern include a numeric feature vector of at least two respective indications selected from:
a type of the access activity;
a number of occurrences of the access activity;
one or more data features representing one or more characteristics of the access activity; and
one or more permission features representing a permission of the host to perform the access activity on the DSD.
7. The method of claim 6 , wherein the one or more data features are determined by a data parsing operation conducted prior to storage of any of the corresponding access activity data in the DSD.
8. The method of claim 1 , wherein the host type is determined by a pre-specified mapping that associates at least one identifier of the host to the host type.
9. The method of claim 8 , wherein the pre-specified mapping is determined according to:
a host-assisted determination process, wherein the host informs the DSD to associate the host with one of a plurality of host types; or
a device-detected determination process, wherein the DSD determines a prior data access pattern of the host and determines the host type from an association between the prior data access pattern and a known data access pattern.
10. The method of claim 1 , wherein determining the host type comprises:
aggregating prior data access patterns of the host based on detection of the one or more access activities of the host;
extracting features related to one or more host types; and
classifying the features to output the host type.
11. The method of claim 1 , wherein at least one of the access activity parameters are determined by calculating an indication of a match between the corresponding detected access activity performed by the host and one or more irregular activities.
12. The method of claim 11 , wherein the one or more irregular activities comprise any one or more of:
one or more irregular commands submitted by the host, wherein identification of a command as irregular is based on one or more expected commands of the host;
data thrashing of pre-fetched data exceeding a system data thrashing threshold; and
one or more irregular activity patterns of the host, wherein identification of an activity pattern as irregular is based on a deviation between one or more observed activity patterns of the host, and one or more learned activity patterns of the host.
13. The method of claim 1 , wherein controlling the access activities of the host to safeguard the DSD comprises one or more of:
initiating an intimation to the host;
conducting one or more rule-based data flushes;
re-authenticating the host;
re-evaluating the host type of the host if the host is re-authenticated;
reducing one or more levels of accessibility permissions; and
blacklisting the host.
14. The method of claim 13 , wherein conducting one or more rule-based data flushes further comprises buffering data received from the host, and in response to determining the security threat level of the host is less than the rogue host threat level, enabling the buffered data to be stored in the DSD.
15. The method of claim 13 , wherein re-authenticating the host further comprises one or more of:
verifying one or more authentication signatures of the host;
verifying an identity of the host; and
determining whether the host is blocked by one or more servers.
16. A data storage device (DSD) comprising:
a non-volatile storage medium configured to store user data;
a data port configured to transmit at least data between the non-volatile storage medium of the data storage device and a host computer system; and
a processor configured to:
determine a host type of the host computer system;
detect one or more access activities performed by the host computer system on the DSD;
process the one or more access activities to determine an observed activity criteria matrix comprised of activity values for the one or more access activities;
retrieve an expected activity criteria matrix comprised of expected values for host behaviour;
determine a set of access activity parameters indicating deviations of the observed activity criteria matrix from the expected activity criteria matrix;
determine a security threat level of the host computer system by weighting one or more corresponding access activity parameters from the set of access activity parameters by one or more impact weights, wherein the one or more impact weights are dynamically determined based on the host type; and
control, in response to determining that the security threat level of the host computer system is greater than or equal to a rogue host threat level, the access activities of the host computer system to safeguard the DSD against the host computer system.
17. The data storage device of claim 16 , wherein the expected activity criteria matrix comprises parameters of an access activity model determined during a training operation for expected access activity of the host type.
18. The data storage device of claim 16 , wherein:
the activity values for the one or more access activities comprise numeric feature vectors;
the observed activity criteria matrix and the expected activity criteria matrix each comprise a matrix of a number of activity patterns by a number of criteria comprising each activity pattern; and
determining the set of access activity parameters comprises calculating the access activity parameter as a normalized numeric value based on comparison of corresponding elements from the observed activity criteria matrix and the expected activity criteria matrix.
19. The data storage device of claim 18 , wherein the activity values of the one or more access activities for an activity pattern comprise a numeric feature vector of at least two respective indications selected from:
a type of the access activity;
a number of occurrences of the access activity;
one or more data features representing one or more characteristics of the access activity; and
one or more permission features representing a permission of the host computer system to perform the access activity on the DSD.
20. A data storage device (DSD) comprising:
a non-volatile storage medium configured to store user data;
means for transmitting at least data between a host and the data storage device;
means for determining a host type of the host;
means for detecting one or more access activities performed by the host on the DSD;
means for processing the one or more access activities to determine an observed activity criteria matrix comprised of activity values for the one or more access activities;
means for retrieving an expected activity criteria matrix comprised of expected values for host behaviour;
means for determining a set of access activity parameters indicating deviations of the observed activity criteria matrix from the expected activity criteria matrix;
means for determining a security threat level of the host by weighting one or more corresponding access activity parameters from the set of access activity parameters by one or more impact weights, and wherein the one or more impact weights are dynamically determined based on the host type; and
means for controlling, in response to determining that the security threat level of the host is greater than or equal to a rogue host threat level, the access activities of the host to safeguard the DSD against the host.