Securing SSDs With Code Signing and Digital Signatures

By Allen Chiu | Apr 8, 2021 | All, Enterprise, Security

SSDs have gained a home both in small-scale personal computers and hyper-scale data centers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform (GCP). SSDs are used to store huge databases with trillions of confidential files and user data. System administrators want help from SSD manufacturers in keeping these files safe. That is why Phison implemented code signing and image signatures.

Code signing

Code signing is a method of using a certificate-based digital signature to sign software and programs to ensure the code has not been changed or corrupted. This method helps developers and the software they write to determine whether some code can be trusted.

Digital signatures

Digital signature verification only allows authorized firmware to run on a device. It prevents the SSD from being hacked from unauthorized firmware upgrades.

HSM (Hardware Security Module)

HSM is a physical computing device that safeguards and manages digital keys for strong authentication and provides crypto processing. The HSM uses strict security certificated standards: FIPS 140-2 Level 3 and common Criteria EAL4+.

FIPS 140-2 is a U.S. government computer security standard used to approve cryptographic modules. It defines four security levels: Level 1 is the lowest of security level and Level 4 provides the highest level of security.

Common Criteria is an international standard for computer security certification.

RSA based code sign flow:

1. Generate firmware digest via SHA256 and PKCS encode method.
2. Generate signature via signer’s private key and RSA-2048 encrypt.
3. Merge the signature and signer’s public key to firmware image packet.

Summary

Code signing is a mandatory feature for high security, government, military, and hyper-scale data centers to ensure personal or confidential information is secure against backdoor hacking.