Peer storage device messaging for vulnerability management
Systems and methods for peer data storage device messaging over a peer channel, such as a control bus, for vulnerability management are disclosed. Storage devices may include a host interface configured to connect to a host system and a peer interface to establish peer communication independent of host availability. The storage devices may determine security issues (for themselves or for peer storage devices) and send a threat notification through the peer interface, enabling peer storage devices to respond to peer security threats without relying on their host connections.
1. A system, comprising:
a first data storage device comprising:
a non-volatile storage medium configured to store host data;
a processor;
a memory;
a host interface configured to connect to a host system via a storage interface bus for receiving storage commands from the host system through first physical channels and transport protocols of the storage interface bus;
a peer interface configured for peer communication with a plurality of peer data storage devices, wherein the peer interface is further configured to connect to a control bus that is physically distinct from the storage interface bus and uses second physical channels and transport protocols that are different than the first physical channels and transport protocols for peer communication;
a vulnerability manager configured to determine a security issue for the first data storage device; and
a peer messaging service configured to send, through the peer interface and responsive to determining the security issue, a threat notification to at least one peer data storage device of the plurality of peer data storage devices.
2. The system of claim 1 , wherein:
the peer interface comprises a control bus interface configured to connect to the control bus, wherein:
a maximum bandwidth of the second physical channels and transport protocols of the control bus is a lower bandwidth than a maximum bandwidth of the first physical channels and transport protocols of the storage interface bus; and
the control bus interface is not configured to receive storage commands from the host system;
the first data storage device further comprises a control bus protocol configured for the peer communication through the control bus and different from a storage interface protocol used for host communication through the storage interface bus; and
the peer communication with the plurality of peer data storage devices is independent of availability of the host system.
3. The system of claim 1 , wherein:
the first data storage device further comprises security configuration data configured to map a plurality of security issue types to a plurality of threat levels; and
the vulnerability manager is further configured to:
determine, based on a security issue type for an identified security issue, a corresponding threat level from the plurality of threat levels; and
selectively change, based on the corresponding threat level, an operating mode of the first data storage device.
4. The system of claim 3 , wherein the identified security issue is selected from:
the security issue for the first data storage device; and
a threat notification received from at least one peer data storage device of the plurality of peer data storage devices.
5. The system of claim 3 , wherein selectively changing the operating mode of the first data storage device comprises entering a read only mode.
6. The system of claim 1 , wherein:
sending the threat notification includes sending a broadcast message to the plurality of peer data storage devices; and
the broadcast message includes a security issue type for the security issue.
7. The system of claim 6 , further comprising:
the plurality of peer data storage devices, wherein:
each peer data storage device of the plurality of peer data storage devices comprises:
a non-volatile storage medium of that peer data storage device;
a host interface of that peer data storage device configured to connect to the host system via the storage interface bus for receiving storage commands from the host system;
a peer interface of that peer data storage device configured for peer communication with the plurality of peer data storage devices via the control bus;
security configuration data for that peer data storage device; and
a vulnerability manager for that peer data storage device configured to determine a response to the broadcast message based on the security issue type and the security configuration data for that peer data storage device; and
a first response by a first peer data storage device of the plurality of peer data storage devices is different than a second response of a second peer data storage device of the plurality of peer data storage devices.
8. The system of claim 1 , wherein:
the peer messaging service is further configured to periodically receive, from the at least one peer data storage device, a threat check message; and
sending the threat notification is responsive to receiving the periodic threat check message.
9. The system of claim 1 , wherein:
the vulnerability manager is further configured to collect device data for determining the security issue; and
the collected device data is selected from:
firmware states;
interface states;
security logs;
cryptography test data;
boot logs; and
debug logs.
10. The system of claim 9 , wherein:
the first data storage device further comprises a threat sharing service configured to select at least a portion of the collected device data for the first data storage device;
the peer messaging service is further configured to:
send, to at least one peer data storage device of the plurality of peer data storage devices, the portion of the collected device data; and
receive, from at least one peer data storage device of the plurality of peer data storage devices, peer device data collected from the at least one peer data storage device; and
the vulnerability manager is further configured to:
analyze the peer device data for security issues;
determine a peer security issue for the at least one peer data storage device; and
determine a response to the peer security issue.
11. A computer-implemented method, comprising:
establishing, from a first data storage device, peer communication with a plurality of peer data storage devices, wherein the first data storage device and each peer data storage device of the plurality of peer data storage devices include:
a non-volatile storage medium configured to store host data;
a host interface configured to connect to a host system via a storage interface bus for receiving storage commands from the host system through first physical channels and transport protocols of the storage interface bus; and
a peer interface configured for peer communication with a plurality of peer data storage devices, wherein the peer interface is further configured to connect to a control bus that is physically distinct from the storage interface bus and uses second physical channels and transport protocols that are different than the first physical channels and transport protocols for peer communication;
determining a security issue for the first data storage device; and
sending, through the peer interface and responsive to determining the security issue, a threat notification to at least one peer data storage device of the plurality of peer data storage devices.
12. The computer-implemented method of claim 11 , wherein:
the peer interface comprises a control bus interface configured to connect to the control bus, wherein:
a maximum bandwidth of the second physical channels and transport protocols of the control bus is a lower bandwidth than a maximum bandwidth of the first physical channels and transport protocols of the storage interface bus; and
the control bus interface is not configured to receive storage commands from the host system;
the first data storage device and each peer data storage device of the plurality of peer data storage devices further include a control bus protocol configured for the peer communication through the control bus and different from a storage interface protocol used for host communication through the storage interface bus; and
the peer communication with the plurality of peer data storage devices is independent of availability of the host system.
13. The computer-implemented method of claim 11 , further comprising:
determining, based on a security issue type for an identified security issue, a corresponding threat level from a plurality of threat levels, wherein the first data storage device and each peer data storage device of the plurality of peer data storage devices further include security configuration data configured to map a plurality of security issue types to the plurality of threat levels; and
selectively changing, based on the corresponding threat level, an operating mode of the first data storage device.
14. The computer-implemented method of claim 13 , further comprising:
receiving, by the first data storage device and from at least one peer data storage device of the plurality of peer data storage devices, a threat notification through the peer interface;
determining the identified security issue from the threat notification; and
determining the security issue type for the identified security issue.
15. The computer-implemented method of claim 13 , wherein selectively changing the operating mode of the first data storage device comprises entering a read only mode.
16. The computer-implemented method of claim 11 , wherein:
sending the threat notification includes sending a broadcast message to the plurality of peer data storage devices; and
the broadcast message includes a security issue type for the security issue.
17. The computer-implemented method of claim 11 , further comprising:
periodically receiving, by the first data storage device and from the at least one peer data storage device, a threat check message, wherein sending the threat notification is responsive to receiving the periodic threat check.
18. The computer-implemented method of claim 11 , further comprising:
collecting, by the first data storage device and each peer data storage device of the plurality of peer data storage devices, device data for determining security issues, wherein the collected device data is selected from:
firmware states;
interface states;
security logs;
cryptography test data;
boot logs; and
debug logs.
19. The computer-implemented method of claim 18 , further comprising:
selecting, by the first data storage device and each peer data storage device of the plurality of peer data storage devices, at least a portion of the collected device data for that data storage device;
sending, from the first data storage device to at least one peer data storage device of the plurality of peer data storage devices, the portion of the collected device data for the first data storage device;
receiving, by the first data storage device and from at least one peer data storage device of the plurality of peer data storage devices, the portion of the collected device data for the at least one peer data storage device;
analyzing, by the first data storage device, the portion of the collected device data for the at least one peer data storage device for security issues;
determining, by the first data storage device, a peer security issue for the at least one peer data storage device; and
determining a response to the peer security issue.
20. A storage system, comprising:
a storage interface bus comprising first physical channels configured for a first transport protocol;
a control bus comprising second physical channels configured for a second transport protocol, wherein the first physical channels and first transport protocol are different from the second physical channels and second transport protocol; and
a plurality of peer data storage devices, wherein each peer data storage device of the plurality of peer data storage devices comprises:
a non-volatile storage medium configured to store host data;
a processor;
a memory;
a host interface configured to connect to a host system via the storage interface bus for receiving storage commands from the host system;
a control bus interface configured to connect to the control bus that is physically distinct from the storage interface bus;
means for establishing, through the control bus interface, peer communication among the plurality of peer data storage devices via the control bus;
means for determining a security issue for a first data storage device of the plurality of peer data storage devices; and
means for sending, through the control bus interface and responsive to determining the security issue, a threat notification to at least one peer data storage device of the plurality of peer data storage devices.