PREVENTION OF CABLE-SWAP SECURITY ATTACK ON STORAGE DEVICES

• US 20160085959A1
• Filed: 09/22/2014
• Published: 03/24/2016
• Est. Priority Date: 09/22/2014
• Status: Active Grant

• Current Assignee: SK Hynix NAND Product Solutions Corporation (SK Hynix Inc.)
• Original Assignee: Intel Corporation
• Inventors: TRIKA, SANJEEV N., COX, JASON, RAMALINGAM, ANAND S.
• Granted Patent: US 9,870,462 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Generally, this disclosure provides systems, devices, methods and computer readable media for prevention of cable swap security attacks on storage devices. A host system may include a provisioning module configured to generate a challenge-response verification key-pair and further to provide the key-pair to the storage device to enable the challenge-response verification. The system may also include a link error detection module to detect a link error between the host system and the storage device. The system may further include a challenge-response protocol module configured to initiate, in response to the link-error detection, a verification challenge from the storage system and to provide a response to the verification challenge based on the key-pair.

Claims

1. A host system for securing a storage device, said host system comprising:

a provisioning module to generate a challenge-response verification key-pair and further to provide said key-pair to said storage device to enable said challenge-response verification;

a link error detection module to detect a link error between said host system and said storage device; and

a challenge-response protocol module to initiate, in response to said link-error detection, a verification challenge from said storage system and further to provide a response to said verification challenge based on said key-pair.

2. The host system of claim 1, wherein said detected link error is associated with a communication reset of a data cable coupled between said host system and said storage device.

3. The host system of claim 1, wherein said detected link error is associated with a disconnect of a data cable coupled between said host system and said storage device.

4. The host system of claim 1, wherein said detected link error occurs during a standby-connected mode of said storage device.

5. The host system of claim 1, further comprising a power-up user authentication module to provide an authentication password to said storage device to unlock said storage device.

6. The host system of claim 1, wherein said storage device is a hard disk drive (HDD) or a solid state drive (SSD).

7. A storage device comprising:

a data storage module to store data for access by a host system coupled to said storage device;

a link error detection module to detect a link error between said storage device and said host system and further, in response to said detection, to cause said storage device to enter a read/write failure mode; and

a challenge-response protocol module to, in response to a verification challenge initiation received from said host system, generate a verification challenge and transmit said verification challenge to said host system.

8. The storage device of claim 7, wherein said challenge-response protocol module is further to verify a challenge-response received from said host system.

9. The storage device of claim 8, wherein, said challenge-response protocol module is further to cause said storage device to exit said read/write failure mode if said verification is successful.

10. The storage device of claim 8, wherein, said challenge-response protocol module is further to wait for a second verification challenge initiation received from said host system if said verification is unsuccessful.

11. The storage device of claim 7, wherein said read/write failure mode is associated with a denial of access to said data storage module by said host system.

12. The storage device of claim 7, further comprising a power-up user authentication module to verify an authentication password received from said host system and further to unlock said data storage module in response to success of said verification.

13. The storage device of claim 7, wherein said detected link error is associated with a communication reset of a data cable coupled between said host system and said storage device.

14. The storage device of claim 7, wherein said detected link error is associated with a disconnect of a data cable coupled between said host system and said storage device.

15. The storage device of claim 7, wherein said detected link error occurs during a standby-connected mode of said storage device.

16. The storage device of claim 7, further comprising an encryption module to lock and unlock said data storage module.

17. The storage device of claim 7, wherein said storage device is a hard disk drive (HDD) or a solid state drive (SSD).

18. At least one computer-readable storage medium having instructions stored thereon which when executed by a processor result in the following operations for securing a storage device, said operations comprising:

generating a challenge-response verification key-pair;

providing said key-pair to said storage device to enable said challenge-response verification;

detecting a link error between a host system and said storage device;

initiating, by said host system, in response to said link-error detection, a verification challenge from said storage system; and

providing a response to said verification challenge based on said key-pair.

19. The computer-readable storage medium of claim 18, wherein said detected link error is associated with a communication reset of a data cable coupled between said host system and said storage device.

20. The computer-readable storage medium of claim 18, wherein said detected link error is associated with a disconnect of a data cable coupled between said host system and said storage device.

21. The computer-readable storage medium of claim 18, wherein said detected link error occurs during a standby-connected mode of said storage device.

22. The computer-readable storage medium of claim 18, further comprising the operation of providing an authentication password to said storage device to unlock said storage device after a power-up of said storage device.

23. At least one computer-readable storage medium having instructions stored thereon which when executed by a processor result in the following operations for securing a storage device, said operations comprising:

detecting a link error between said storage device and a host system;

entering a read/write failure mode in response to said detection;

receiving a verification challenge initiation from said host system;

generating a verification challenge in response to said receiving; and

transmitting said verification challenge to said host system.

24. The computer-readable storage medium of claim 23, further comprising the operation of verifying a challenge-response received from said host system.

25. The computer-readable storage medium of claim 24, further comprising the operation of exiting said read/write failure mode if said verification is successful.

26. The computer-readable storage medium of claim 24, further comprising the operation of waiting for a second verification challenge initiation from said host system if said verification is unsuccessful.

27. The computer-readable storage medium of claim 23, wherein said read/write failure mode is associated with a denial of access of said host system to data stored on said storage device.

28. The computer-readable storage medium of claim 24, further comprising the operations of verifying an authentication password received from said host system and unlocking data stored on said storage device in response to success of said verification.

29. The computer-readable storage medium of claim 23, wherein said detected link error is associated with a communication reset of a data cable coupled between said host system and said storage device.

30. The computer-readable storage medium of claim 23, wherein said detected link error is associated with a disconnect of a data cable coupled between said host system and said storage device.