About 80% of enterprises have experienced at least one firmware attack in the last two years* What is firmware resilience, how does it apply to SSDs to address these threats? - Not a new concept. Elements of Resiliency have been around for years (multiple FW slots / copies, etc.) - Platform Firmware Resiliency Guideline (NIST SP800-193) was published in 2018 - Industry momentum around resiliency has seen from Intel**, Lattice*** and PC OEMs - Still an emerging area that we see proprietary implementations from different vendors As SSD solution provider, we want to help define a unified solution in the area of SSD recovery - Possible approach (and challenges) in client storage space where: All firmware binaries are immutable code and hence are always RSA digitally signed. They are subjected to RSA public key signature verification before being used Multiple firmware slots with copies within each slot as redundant firmware images for SSD auto recovery When SSD auto recovery failed, some mechanisms for host to discover host assisted recovery is required (i.e. either via PCIe or SMBus) When in host assisted recovery mode, device supports a limited number of admin commands for recovery (i.e. Identify, fw download/commit, Get Log Page) Require user intervention to initiate a host assisted (typically initiated via BIOS menu option) semi-automatic recovery Using a golden image maybe saved in BIOS, it is expected to restore to SSD manufacturer default state without preserving user data and any security parameters - Possible approach (and challenges) in data center storage space where: Recovery of device FW SHALL occur over a management interface Recovery of device FW SHALL only occur after a catastrophic event (e.g. no device self-recovery mechanisms succeed, FW attestation failure, etc.) Device SHALL advertise it’s need for recovery (e.g. OCP Recovery specification) FW image used for recovery SHALL be provided to the device over the management interface When a device is in need of recovery, the MANDATORY goal is device recovery. An OPTIONAL goal is recovery of user data. - Call to action to address perceived challenges Examples include… How to maintain a “golden” recovery image? Is there really such a thing? What are the industry defined interfaces to invoke recovery? Other gaps in industry specifications around recovery *Based on Microsoft’s Security Signals report published in 2021: https://www.microsoft.com/security/blog/2021/03/30/new-security-signals-... ** Intel Platform Firmware Resiliency (Intel® PFR): https://www.intel.com/content/www/us/en/products/docs/processors/xeon/pl... *** Lattice Universal Platform Firmware Resiliency (PFR) – Servers implementation: https://www.latticesemi.com/pfr
SSD Firmware Resilience: Approaches & Challenges to protect against emerging threats
- Provide the audience with general understanding of Firmware Resiliency, as defined in NIST SP800-193
- Provide possible approaches to providing the resiliency capability in both Client and Datacenter storage devices
- Raise awareness of perceived gaps in industry standards around Resiliency and provide a call to action
---
- Winson YungSolidigm
2022 has been an interesting and challenging year for storage security.
Ransomware attack mitigation has been a high profile problem and is getting more visibility in recent years due to the high payback from victims to have their data released.
The Key Per IO (KPIO) project is a joint initiative between NVM Express® and the Trusted Computing Group (TCG) Storage Work Group to define a new KPIO Security Subsystem Class (SSC) under TCG Opal
- Festus HategekimanaSolidigm Technology
Almost everyone understands that systems and data both have lifecycles that typically include a disposal phase (i.e., what you do when you do not need something anymore).
- John GeldmanKioxia
A nation-state attack on the SolarWinds network management system in December 2020 compromised the supply chains of over 18,000 organizations, including the Pentagon and the Department of Homeland
Zero Trust is a collection of security methodologies that work together to enforce access, with the view that your network has already been compromised, and using contextual information from identi
The Quantum computing paradigm shift has changed the way we look at data security these days, especially the long-term security of data.
- Dr. Amin RezaeiCalifornia State University Long Beach
- Dr. Ava HedayatipourCalifornia State University Long Beach
SNIA Developer Conference
September 15-17, 2025
SDC 2025 is brought to you by SNIA. SNIA is an industry association committed to its mission of worldwide leadership developing and promoting architectures, standards, education and vendor-neutral collaboration.
