CertiFlash: A Formal Verification Framework for Flash Translation Layers in Computational Solid State Drives
CertiFlash provides machine-checked formal verification of SSD flash translation layers, proving isolation, integrity, and ownership invariants to prevent tenant data leaks.
CertiFlash is an open-source formal verification framework for Flash Translation Layers (FTL) in computational SSDs, mechanized in the Rocq proof assistant. It shows that a faulty FTL can corrupt device state at five surfaces (e.g., leaking data between tenants or dropping integrity tags), demonstrated on a DaisyPlus OpenSSD. Designers prove once that every operation of a general FTL model preserves a global invariant covering mapping, isolation, integrity, ownership, and allocation; new designs need only discharge five hypotheses. Across four case studies, added effort was 27-3,231 lines against a 16,489-line framework.
- Faulty FTL can cross tenant data boundaries even when functionally correct
- Single machine-checked proof covers security plus functional correctness
- New FTL designs verify by discharging five hypotheses, not redoing proofs
- Validated across four case studies on OpenSSD hardware
Full article276 words · extracted from arxiv.org · click to collapse
Data-intensive applications move large amounts of data from storage to the compute unit, incurring significant data movement overhead. Storage-centric computing reduces this overhead by moving computation near or inside solid-state drives (SSDs). Enabling it requires modifying SSD policies, e.g., address translation and garbage collection, which are part of the Flash Translation Layer (FTL), the SSD's firmware. Modifying the FTL is error-prone. Because FTL logic has direct access to security-critical device components, even a functionally correct FTL can leak data between tenants, drop integrity tags, or assign a flash block to the wrong tenant. We show that a faulty FTL can corrupt the device state at five surfaces inside the SSD, and demonstrate them on a DaisyPlus OpenSSD. Prior work verifies individual FTL designs, but has two limitations. (1) It establishes only functional correctness, so a modified FTL can violate isolation, integrity, and ownership and still pass verification. (2) It is tied to a single FTL design, so every modification requires redoing every proof. We propose CertiFlash, a formal verification framework for FTLs, mechanized in the Rocq proof assistant, that gives designers a machine-checked proof of security and correctness. CertiFlash models an FTL as a deterministic state machine with a single global invariant over mapping, isolation, integrity, ownership, and allocation. We prove once, over a general FTL model, that (i) every FTL operation preserves the invariant and (ii) the model refines an idealized block device. For a new design, a designer discharges five hypotheses about its own operations instead of redoing either proof. Across four case studies, a designer adds 27 to 3,231 lines against a 16,489-line framework, significantly reducing the verification effort. CertiFlash is open source.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.10347