Detection of compromised storage device firmware

A method, comprising:

• monitoring a control bus of a non-volatile storage device comprising a processor coupled to the control bus and a plurality of electronic components each coupled to the control bus;
• analyzing signal traffic on the control bus for events for a storage operation initiated on the control bus by the processor, the storage operation comprising one or more commands directed to at least one of the plurality of electronic components;
• measuring a latency for the storage operation;
• determining that the latency for the storage operation satisfies an alert threshold;
• notifying a host of a compromised firmware in response to the storage operation satisfying the alert threshold;
• and
• receiving a firmware monitoring request from the host at a security chip coupled to the control bus, the security chip operating independent of the processor and independent of firmware executing on the processor, the security chip configured to notify the host of compromised firmware based on one or more target storage operations, wherein in response to receiving the firmware monitoring request, establishing a secure communication channel between the security chip and the host, the secure communication channel configured to be inaccessible to the firmware executing on the processor.

An apparatus, comprising:

• a communication bus;
• a memory coupled to the communication bus, the memory configured to store a storage security firmware image, an alert threshold, and a repository comprising latency data;
• a processor coupled to the communication bus, the processor configured to execute the storage security firmware image comprising:
• a monitor configured to generate latency data for a target storage operation, the target storage operation identified based on signal traffic on the communication bus;
• a detector configured to:
• determine an anomaly based on the latency data for the target storage operation, wherein the determining comprises:
• determining that a latency of the storage operation comprises a first anomaly in response to the latency satisfying an alert threshold for the storage operation and the storage operation comprises a predictable storage operation;
• and/or
• determining that the latency of the storage operation comprises a second anomaly in response to the latency satisfying an anomaly detector for the storage operation and the storage operation comprises a semi-predictable storage operation;
• and
• a reporter configured to signal a host in response to the detector identifying the anomaly indicating a compromised storage controller firmware image;
• and
• a communication module coupled to the communication bus and configured to communicate the anomaly to the host.