Sideband authentication of storage device
Various aspects include a continuous authentication system for a storage system. The continuous authentication system includes a host having an encryption unit. The continuous authentication system includes a storage device having a decryption unit. The continuous authentication system includes a first physical connection between the host and the storage device. The first physical connection may be configured to transfer I/Os. The continuous authentication system may include a second physical connection between the host and the storage device. The encryption unit may be configured to encrypt a continuous authentication signal. The host may be configured to transmit the continuous authentication signal through the second physical connection. The storage device may be configured to receive the continuous authentication signal through the second physical connection. The decryption unit may be configured to decrypt the continuous authentication signal. When the second physical connection is tampered with, the storage device may stop processing the I/Os.
1. A system, comprising:
a host including an encryption unit;
a storage device including a decryption unit;
a first physical connection between the host and the storage device, wherein the first physical connection is configured to transfer one or more input/output requests (I/O); and
a second physical connection between the host and the storage device, wherein:
the encryption unit is configured to encrypt an authentication signal;
the host is configured to transmit the authentication signal using the second physical connection;
the storage device is configured to receive the authentication signal using the second physical connection;
the decryption unit is configured to decrypt the authentication signal;
the storage device is configured to process the one or more I/O using the first physical connection based on the authentication signal received using the second physical connection; and
the first physical connection includes at least one of a wire, a fiber optic medium, a bus, or a fabric.
2. The system of claim 1 , wherein:
the first physical connection supports a first protocol having a first performance characteristic;
the second physical connection supports a second protocol having a second performance characteristic; and
the first performance characteristic of the first protocol is at least one of a) higher bandwidth or b) higher throughput than the second performance characteristic of the second protocol.
3. The system of claim 2 , wherein the first physical connection is associated with a main data path, and the second physical connection is associated with a sideband signal channel.
4. The system of claim 1 , wherein:
the storage device further includes a solid state drive (SSD) controller;
the SSD controller includes the decryption unit; and
the decryption unit includes a back side illumination (BSI) complementary metal-oxide-semiconductor (CMOS) image sensor.
5. The system of claim 4 , wherein the BSI CMOS image sensor is configured to detect a state of the authentication signal.
6. The system of claim 4 , wherein:
the SSD controller includes a substrate; and
the BSI CMOS image sensor includes a light receiving part that is disposed on a back side of the substrate.
7. The system of claim 6 , wherein the light receiving part comprises a pixel.
8. The system of claim 6 , wherein the light receiving part includes a micro-lens.
9. The system of claim 1 , wherein:
the storage device further includes one or more storage enclosures;
the one or more storage enclosures includes one or more SSD controllers; and
the decryption unit is associated with the one or more SSD controllers of the one or more storage enclosures.
10. The system of claim 1 , wherein:
the storage device further includes one or more storage racks;
the one or more storage racks includes one or more storage enclosures;
the one or more storage enclosures includes one or more SSD controllers; and
the decryption unit is associated with the one or more SSD controllers of the one or more storage enclosures of the one or more storage racks.
11. The system of claim 1 , wherein the storage device is further configured to:
receive a first transmission of the authentication signal using the second physical connection;
receive a second transmission of the authentication signal using the second physical connection;
determine that the first transmission of the authentication signal and the second transmission of the authentication signal provide an indication of a secure connection; and
process the one or more I/Os using the first physical connection based on the indication.
12. A system, comprising:
a host including an encryption unit;
a storage device including a decryption unit;
a first physical connection between the host and the storage device, wherein the first physical connection is configured to transfer one or more input/output requests (I/O); and
a second physical connection between the host and the storage device, wherein:
the encryption unit is configured to encrypt an authentication signal;
the host is configured to transmit the authentication signal using the second physical connection;
the storage device is configured to receive the authentication signal using the second physical connection;
the decryption unit is configured to decrypt the authentication signal;
the storage device is configured to process the one or more I/O using the first physical connection based on the authentication signal received using the second physical connection; and
the authentication signal includes a periodically incrementing integer value.
13. The system of claim 12 , wherein the storage device is configured to stop processing the one or more I/O in response to the periodically incrementing integer value having a non-chronological increment.
14. The system of claim 12 , wherein the storage device is configured to return one or more signals to the host through the first physical connection in response to the periodically incrementing integer value having a non-chronological increment through the second physical connection.
15. The system of claim 12 , wherein the storage device is configured to stop processing the one or more I/O in response to not receiving the periodically incrementing integer value for a period of time that exceeds a threshold value.
16. The continuous authentication system of claim 12 , wherein the storage device is configured to return one or more invalid signals to the host through the first physical connection in response to not receiving the periodically incrementing integer value for a period of time that exceeds a threshold value.
17. A system, comprising:
a host including an encryption unit;
a storage device including a decryption unit;
a first physical connection between the host and the storage device, wherein the first physical connection is configured to transfer one or more input/output requests (I/O); and
a second physical connection between the host and the storage device, wherein:
the encryption unit is configured to encrypt an authentication signal;
the host is configured to transmit the authentication signal using the second physical connection;
the storage device is configured to receive the authentication signal using the second physical connection;
the decryption unit is configured to decrypt the authentication signal;
the storage device is configured to process the one or more I/O using the first physical connection based on the authentication signal received using the second physical connection; and
the second physical connection includes at least one of a) a fiber optic medium or b) a wire.