# US 2018/0322285 A1 · System and method for detecting malicious software in nvme over fabrics devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0322285 A1
- Document ID: US20180322285A1
- Status: Published application
- Kind: A1
- Application number: 15/690,265
- Filed: 2017-08-29
- Published: 2018-11-08
- Earliest claimed: 2017-05-03
- Assignees: Samsung Electronics Co., Ltd.
- Applicants: Samsung Electronics Co., Ltd.
- Inventors: Sompong Paul OLARIG; Ramdas P. KACHARE; Son T. PHAM
- Web page: https://patentgrep.com/patent/US20180322285A1

## CPC

- G06F 21/562: {Static detection}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/564: {by virus signature recognition}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and a method to detect malicious software written to an Ethernet solid-state drive (eSSD). The system includes an Ethernet switch, at least one SSD, and a baseboard management controller (BMC). The Ethernet switch receives write data from a communication network in response to a write command. The at least one SSD receives the write data from the Ethernet switch and stores the received write data. The BMC receives from the at least one SSD the received write data. The BMC determines whether the received write data contains malicious software. The received write data may be contained in a plurality of Ethernet packets in which case the BMC stores the received write data in a scan buffer in an order that is based on an assembled order of the received write data.

## Claims

### Claim 1

A system, comprising:
an Ethernet switch to receive write data from a communication network in response to a write command;
at least one solid-state drive (SSD) coupled to the Ethernet switch, the at least one SSD to receive the write data from the Ethernet switch and store the received write data; and
a baseboard management controller (BMC) coupled to the at least one SSD, the BMC to receive from the at least one SSD the received write data and to determine whether the received write data contains malicious software.

### Claim 2 (depends on 1)

The system of claim 1, wherein if the BMC determines that the received write data contains malicious software, the BMC disables access to the at least one SSD.

### Claim 3 (depends on 1)

The system of claim 1, wherein the malicious software comprises a software virus.

### Claim 4 (depends on 1)

The system of claim 1, wherein the at least one SSD is coupled to the BMC through a Peripheral Component Interface Express (PCIe) based communication link, and
wherein the BMC receives the write data over the PCIe-based communication link.

### Claim 5 (depends on 1)

The system of claim 1, wherein the received write data is contained in a plurality of Ethernet packets, and
wherein the BMC stores the received write data in a scan buffer in an order that is based on an assembled order of the received write data.

### Claim 6 (depends on 1)

The system of claim 1, wherein the SSD comprises an Ethernet SSD (eSSD).

### Claim 7 (depends on 1)

The system of claim 1, further comprising a central processing unit (CPU) to run at least on software-defined network protocols associated with the Ethernet switch.

### Claim 8

A system, comprising:
an Ethernet switch to receive write data from a communication network in response to a write command;
at least one solid-state drive (SSD) coupled to the Ethernet switch, the at least one SSD to receive the write data from the Ethernet switch and store the received write data; and
a baseboard management controller (BMC) coupled to the at least one SSD, the BMC comprising a memory receive from the SSD the received write data, the BMC to further scan the received write data in the memory to determine whether the received write data contains malicious software.

### Claim 9 (depends on 8)

The system of claim 8, further comprising a Peripheral Component Interface Express (PCIe) switch coupled between the at least one SSD and the BMC,
wherein the BMC receives the write data from the at least one SSD through the PCIe switch.

### Claim 10 (depends on 8)

The system of claim 8, wherein if the BMC determines that the received write data contains malicious software, the BMC disables access to the at least one SSD.

### Claim 11 (depends on 8)

The system of claim 8, wherein the malicious software comprises a software virus.

### Claim 12 (depends on 8)

The system of claim 8, wherein the received write data is contained in a plurality of Ethernet packets, and
wherein the BMC stores the received write data in a scan buffer in the memory in an order that is based on an assembled order of the received write data.

### Claim 13 (depends on 8)

The system of claim 8, wherein the SSD comprises an Ethernet SSD (eSSD).

### Claim 14 (depends on 8)

The system of claim 8, further comprising a central processing unit (CPU) to run at least on software-defined network protocols associated with the Ethernet switch.

### Claim 15

A method to detect malicious software written to a solid-state drive (SSD) connected to an Ethernet communication network, the method comprising:
receiving write data at the SSD over the Ethernet communication network in response to a write command;
storing the write data in the SSD;
sending the write data to a baseboard management controller (BMC);
scanning at the BMC the write data sent to the BMC; and
determining whether the write data contains malicious software.

### Claim 16 (depends on 15)

The method of claim 15, wherein if determining whether the write data contains malicious software determines that the write data contains malicious software, the method further comprises
disabling access to the SSD.

### Claim 17 (depends on 16)

The method of claim 16, wherein the malicious software comprises a software virus.

### Claim 18 (depends on 15)

The method of claim 15, wherein sending the write data to the BMC comprises sending the write data to the BMC over a Peripheral Component Interface Express (PCIe) based communication link.

### Claim 19 (depends on 15)

The method of claim 15, wherein the write data is contained in a plurality of Ethernet packets, and
wherein scanning at the BMC the write data sent to the BMC further comprises:
storing at the BMC the write data in a scan buffer in an order that is based on an assembled order of the write data.

### Claim 20 (depends on 15)

The method of claim 15, wherein the SSD comprises an Ethernet SSD (eSSD).