Classifying Solid State Drive Firmware via Side-Channel Current Draw Analysis

Solid State Drives (SSDs) are a form of non-volatile computer memory that have become ubiquitous in the information technology industry, replacing traditional magnetic Hard Disk Drives (HDDs) in numerous conventional systems and enabling new applications in the fields of embedded systems and data infrastructure. Compared to HDDs, modern SSDs have competitive storage density, faster read and write times, lower power consumption, and greater impact resistance. However, compared to HDD technology, SSDs have a more complex data storage architecture, which necessitates integrated firmware that interfaces between a host system and the hardware of the SSD, called the Flash Translation Layer (FTL). Because the host system interacts only with the FTL and not the SSD itself, the SSD can be viewed as a black box system, with known input and output but no information about its inner workings. Characterizing internal operations of an SSD is relevant for forensics, diagnostics, and security applications. One possible solution to this problem is to observe the side-channel current draw of the SSD as it operates. If firmware variants have distinguishable differences in their current signatures, a classifier can be trained to make class predictions. Investigating this proposed solution, the current draw of two firmware versions of a Crucial SSD were analyzed as the drive executed a series of file operations. Identifying relevant signal features, standard machine learning techniques were employed to develop models that correctly classified the firmware loaded on the SSD with over 98% accuracy given only a recording of their current draw signals during file operations.