Securing hard drives with the Security Protocol and Data Model (SPDM)

Abstract

Efforts to secure computing systems via software traditionally focus on the operating system and application levels. In contrast, the Security Protocol and Data Model (SPDM) tackles firmware level security challenges, which are much harder (if at all possible) to detect with regular protection software. SPDM includes key features like enabling peripheral authentication, authenticated hardware measurements retrieval, and secure session establishment. Since SPDM is a relatively recent proposal, there is a lack of studies evaluating its performance impact on real-world applications. In this article, we address this gap by: (1) implementing the protocol on a simple virtual device, and then investigating the overhead introduced by each SDPM message; and (2) creating an SPDM-capable virtual hard drive based on VirtIO, and comparing the resulting read/write performance with a regular, unsecured implementation. Our results suggest that SPDM bootstrap time takes the order of tens of milliseconds, while the toll of introducing SPDM on hard drive communication highly depends on specific workload patterns. For example, for mixed random read/write operations, the slowdown is negligible in comparison to the baseline unsecured setup. Conversely, for sequential read or write operations, the data encryption process becomes the bottleneck, reducing the performance indicators by several orders of magnitude.

Light-Weight Security Protocol and Data Model for Chip-to-Chip Zero-Trust

“…In addition, the PCI express (PCIe) integrity and data encryption key management (IDE_KM) protocol [33] for link encryption and other application protocols are built on top of the SPDM protocol. It standardizes the authentication of hardware components and enables the establishment of secure communication channels among them [34]. The protocol allows endpoints to discover and negotiate each other's security capabilities and to retrieve each other's measurements, which include the configurations of the hardware and the firmware.…”

Fuzzing para o Protocolo TLS: Estado da Arte e Comparação de Fuzzers Existentes

“…Recentemente, o TLS influenciou a especificac ¸ão do SPDM (Security Protocol and Data Model), um padrão aberto proposto pela DMTF (Distributed Management Task Force) que define um conjunto de mecanismos e formatos para autenticac ¸ão de hardware e firmware [DMTF 2023]. O SPDM pode ser usado por exemplo para aumentar a seguranc ¸a nas leituras e escritas de um disco rígido [Alves et al 2022]. Dada a relac ¸ão entre o TLS e o SPDM e a descoberta de falhas em implementac ¸ões do TLS com o uso de fuzzers [Beurdouche et al 2017], é razoável considerar a seguinte pergunta de pesquisa: Qual a eficácia de adaptar fuzzers do TLS para o SPDM?…”