Securing HDF5 Plugins with Digital Signatures

HDF5 is a popular data management and I/O library used by numerous scientific and industry applications. HDF5 has pluggable extensions to enhance its functionality, improve performance, and utilize underlying hardware and file systems. Plugins play a crucial role in adding custom features, such as compression filters, virtual file drivers (VFDs), and virtual object layer (VOL) connectors, without requiring extensive changes to the source code or modifications to the main library. While the plugin capability enables the extension of HDF5, plugins could be misused for malicious routing of HDF5 calls. To systematically improve the security of HDF5, this study explores the option of digitally signing plugins. This would help ensure the authenticity and integrity of any plugins that users may use. We discuss a few implementation scenarios in HDF5 and assess the accuracy and overhead associated with the plugin verification process.