Prevention of cable-swap security attack on storage devices

A storage device disposed in a storage system in communication with a host system, comprising:

• data storage circuitry to store data for access by a host system coupled to said storage device;
• power-up user authentication circuitry to verify an authentication password received from said host system and unlock said data storage circuitry in response to success of said verification;
• link error detection circuitry, disposed in said storage system and in said host system, to detect a link error between said storage device and said host system occurring during a standby-connected mode of said storage device and further, in response to said link-error detection, to cause said storage device to generate failures on all read/write operations received from said host system while said storage device continues to receive power;
• and
• challenge-response protocol circuitry, disposed in said storage system and in said host system, to, in response to a verification challenge initiation received from said host system, generate a verification challenge and transmit said verification challenge to said host system, wherein said verification challenge is to secure said storage device against a cable-swap attack and wherein a successful response to said verification challenge causes said link error detection circuitry in said storage system to discontinue generating said read/write failures.

At least one non-transitory computer-readable storage medium, disposed in a storage system, said storage system in communication with a host system, wherein link error detection circuitry is disposed in said storage system and in said host system, and wherein challenge-response protocol circuitry is disposed in said in said storage system and in said host system, said at least one non-transitory computer readable storage medium having instructions stored thereon which when executed by a processor result in the following operations for securing a storage device, said operations comprising:

• providing an authentication password to said storage device to unlock said storage device after a power-up of said storage device;
• generating a challenge-response verification public/private encryption key-pair;
• providing said key-pair to said storage device to enable said challenge-response verification;
• detecting a link error between a host system and said storage device occurring during a standby-connected mode of said storage device;
• initiating, by said host system, in response to said link-error detection, a verification challenge from said storage device, wherein said verification challenge is to secure said storage device against a cable-swap attack by generating failures on all read/write operations from said host system until a successful response to said verification challenge is received;
• and
• providing a response to said verification challenge based on said key-pair.

At least one non-transitory computer-readable storage medium disposed in a storage system, said storage system in communication with a host system, wherein link error detection circuitry is disposed in said storage system and in said host system, and wherein challenge-response protocol circuitry is disposed in said storage system and in said host system, said at least one non-transitory computer-readable storage medium having instructions stored thereon which when executed by a processor result in the following operations for securing a storage device, said operations comprising:

• verifying a challenge-response received from said host system;
• upon success of said challenge-response verification, verifying an authentication password received from said host system;
• upon success of said authentication password verification, unlocking data stored on said storage device in response to success of said verification;
• detecting a link error between said storage device and a host system occurring during a standby-connected mode of said storage device;
• generating failures on all read/write operations from said host system in response to said detection while said storage device continues to receive power;
• receiving a verification challenge initiation from said host system;
• generating a verification challenge in response to said receiving, wherein said verification challenge is to secure said storage device against a cable-swap attack and wherein a successful response to said verification challenge causes generation of said read/write failures to discontinue;
• and
• transmitting said verification challenge to said host system.