R&D: Forensic Issues and Techniques to Improve Security in SSD With Flex Capacity Feature

IEEE Access has published an article written by Na Young Ahn, Institute of Cyber Security and Privacy, Korea University, Seoul, South Korea, and Dong Hoon Lee, Graduate School of Information Security, Korea University, Seoul, South Korea.

Forensic Target in OP area

Abstract: “Over-provisioning technology is typically introduced as a means to improve the performance of storage systems, such as databases. The over-provisioning area is both hidden and difficult for normal users to access. This paper focuses on attack models for such hidden areas. Malicious hackers use advanced over-provisioning techniques that vary capacity according to workload, and as such, our focus is on attack models that use variable over-provisioning technology. According to these attack models, it is possible to scan for invalid blocks containing original data or malware code that is hidden in the over-provisioning area. In this paper, we outline the different forensic processes performed for each memory cell type of the over-provisioning area and disclose security enhancement techniques that increase immunity to these attack models. This leads to a discussion of forensic possibilities and countermeasures for SSDs that can change the over-provisioning area. We also present information-hiding attacks and information-exposing attacks on the invalidation area of the SSD. Our research provides a good foundation upon which the performance and security of SSD-based databases can be further improved.“