Patent Description:
Reliable authentication of storage devices can be important. Some vendors may be encrypting data using public key encryption. However, some standards such as Peripheral Component Interconnect Express (PCIE) and Non-Volatile Memory Express (NVME) protocol standards, which are used in the storage industry, may not provide a suitable mechanism to protect a command. Instead, such protocols may only encrypt payload data. Thus, if a public key is known, an entity can access the data from the storage device in an offline condition (i.e., after detaching the storage device from the host system).

<CIT> discloses: For digital rights management (DRM), a method for performing authentication between a device and a portable storage, which is performed by the device, includes transmitting a first key to the portable storage, receiving a third key and a first encrypted random number obtained by encrypting a first random number using the first key from the portable storage and decrypting the first encrypted random number using a second key related with the first key, generating a second encrypted random number by encrypting a second random number using the third key and transmitting the second encrypted random number to the portable storage, and generating a session key using the first random number and the second random number. The technique guarantees secure authentication between the device and the portable storage for DRM.

The present invention is defined by the independent claim. Further developments of the invention are defined by the dependent claims. Various embodiments of the disclosure include a continuous authentication system. The continuous authentication system may include a host having an encryption unit. The continuous authentication system may include a storage device having a decryption unit. The continuous authentication system may include a first physical connection between the host and the storage device. The first physical connection may be configured to transfer one or more input/output requests (I/Os). The continuous authentication system may include a second physical connection between the host and the storage device. The encryption unit may be configured to encrypt a continuous authentication signal. It will be understood that the term "continuous" may include a periodic authentication signal, and/or multiple discrete authentication signals. The host may be configured to transmit the continuous authentication signal through the second physical connection. The storage device may be configured to receive the continuous authentication signal through the second physical connection. The decryption unit may be configured to decrypt the continuous authentication signal.

The foregoing and additional features and advantages of the present disclosure will become more readily apparent from the following detailed description, made with reference to the accompanying figures, in which:.

Reference will now be made in detail to embodiments disclosed herein, examples of which are illustrated in the accompanying drawings. In the following detailed description, numerous specific details are set forth to enable a thorough understanding of the inventive concept. It should be understood, however, that persons having ordinary skill in the art may practice the inventive concept without these specific details.

For example, a first interface could be termed a second interface, and, similarly, a second interface could be termed a first interface, without departing from the scope of the inventive concept.

The terminology used in the description of the inventive concept herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the inventive concept. As used in the description of the inventive concept and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The components and features of the drawings are not necessarily drawn to scale.

Embodiments disclosed herein include a continuous authentication system to protect from unauthorized access to a storage device, for example, when the storage device is disconnected from a host device. The host device can transmit a periodic authentication signal via a sideband channel. When the storage device is installed for a first time, the host device may start to give an incremental counter number, periodically, to the storage device in encrypted form. The storage device may permit operations to be performed when a valid counter number is received from the host device. In some embodiments, the storage device may permit operations to be performed only when a valid counter number is received from the host device.

For example, when the storage device is initially installed, the host device may provide an initial counter value to the storage device, in encrypted form, through a sideband channel, which may be separated from a main data path. The host device may send an incremental counter number to the storage device, periodically, through the sideband channel. When the storage device does not receive one or more valid counter numbers that are increasing periodically, the storage device may stop performing normal operations, and may respond with an invalid signal for all commands received from the host system from that point forward in time. The counter number can be transferred in a slower sideband channel, instead of a faster main data bus, for implementation cost efficiency, and to avoid interfering with the transfer of I/Os between the host device and the storage device.

<FIG> is an example diagram of a continuous authentication system <NUM> in accordance with some embodiments. The continuous authentication system <NUM> may include a host device <NUM> and a storage device <NUM>. The host device <NUM> may include an encryption unit <NUM>. The storage device <NUM> may include a decryption unit <NUM>. The continuous authentication system <NUM> may include a first physical connection <NUM> between the host device <NUM> and the storage device <NUM>. The first physical connection <NUM> may transfer one or more I/Os <NUM> between the host device <NUM> and the storage device <NUM>. The continuous authentication system <NUM> may include a second physical connection <NUM> between the host device <NUM> and the storage device <NUM>.

The encryption unit <NUM> may encrypt a continuous authentication signal <NUM>. The host device <NUM> may transmit the continuous authentication signal <NUM> through the second physical connection <NUM>. The storage device <NUM> may receive the continuous authentication signal <NUM> through the second physical connection <NUM>. The decryption unit <NUM> may decrypt the continuous authentication signal <NUM>.

The continuous authentication signal <NUM> may include a periodically incrementing integer value, for example. Hereinafter, the continuous authentication signal <NUM> may be referred to as periodically incrementing integer value. In some embodiments, the storage device <NUM> may stop processing the one or more I/Os <NUM> in response to the periodically incrementing integer value <NUM> missing a chronological increment and/or having a non-chronological increment. In some embodiments, the storage device <NUM> may return one or more invalid signals <NUM> to the host device <NUM> through the first physical connection <NUM> in response to the periodically incrementing integer value <NUM> missing a chronological increment and/or having a non-chronological increment through the second physical connection <NUM>. In some embodiments, the storage device <NUM> is configured to stop processing the one or more I/Os <NUM> in response to not receiving the periodically incrementing integer value <NUM> for a period of time that exceeds a threshold value. The storage device <NUM> may return the one or more invalid signals <NUM> to the host device <NUM> through the first physical connection <NUM> in response to not receiving the periodically incrementing integer value <NUM> for a period of time that exceeds the threshold value.

The threshold value can be selected such that it is long enough to detect when the second physical connection <NUM> has likely been tampered with, but not too long that false positives are generated. For example, the threshold value can be on the order of seconds, such as about <NUM> second, about <NUM> seconds, about <NUM> seconds, about <NUM> seconds, about <NUM> seconds, or so forth. In some embodiments, the threshold value can be less than a second. In some embodiments, the threshold value can be more than <NUM> seconds.

In some embodiments, the second physical connection <NUM> may include a fiber optic medium. In some embodiments, the second physical connection <NUM> may include a wire or other suitable conductor. In some embodiments, the first physical connection <NUM> includes at least one of a wire, a fiber optic medium, a bus, a switch, a fabric, or other suitable conductor. The first physical connection <NUM> may support a first protocol having a first performance characteristic. The second physical connection <NUM> may support a second protocol having a second performance characteristic. The first performance characteristic of the first protocol may be faster (e.g., higher bandwidth and/or higher throughput) than the second performance characteristic of the second protocol. In other words, the sideband signal channel (e.g., the second physical connection <NUM>) can be implemented in a relatively slow connection in comparison to the main data path (e.g., the first physical connection <NUM>). Hereinafter, the second physical connection <NUM> may be referred to as a sideband signal channel or a sideband authentication channel. This approach provides implementation efficiency, while eliminating the possibility that the continuous authentication signal <NUM> interferes with otherwise valid I/Os being transferred between the host device <NUM> and the storage device <NUM> via the first physical connection <NUM>. The protocol used for transferring the one or more I/Os may include, for example, PCIE, NVME, Ethernet, Infiniband®, transmission control protocol/Internet protocol (TCP/IP), Fibre Channel, or the like. In an alternative embodiment, the continuous authentication signal <NUM> is transmitted inband via the first physical connection <NUM>, and in such an embodiment, the second physical connection <NUM> is not needed.

<FIG> is an example diagram of the continuous authentication system <NUM> of <FIG> showing example details in accordance with some embodiments. The host device <NUM> may include a counter value generator <NUM>, which can be coupled to or otherwise part of the encryption unit <NUM>. The storage device <NUM> may include a counter value checker <NUM>, which is coupled to or otherwise part of the decryption unit <NUM>. The counter value generator <NUM> may generate a periodically incrementing integer value <NUM>, for example, in beacon signal fashion. The encryption unit <NUM> may encrypt the periodically incrementing integer value <NUM>. The decryption unit <NUM> may decrypt the periodically incrementing integer value <NUM>. The counter value checker <NUM> may check the periodically incrementing integer value <NUM>. The periodically incrementing integer value <NUM> may be transmitted via the sideband authentication channel <NUM>. When the counter value checker <NUM> detects an anomaly in the periodically incrementing integer value <NUM>, then the storage device <NUM> may stop processing the one or more I/Os, and may instead send invalid responses to the host device <NUM> through the first physical connection <NUM> for any command issued by the host device <NUM> from that point forward.

<FIG> is an example timing flow diagram <NUM> of the operation of the continuous authentication system (e.g., <NUM> of <FIG>) in accordance with some embodiments. The direction of time is shown by the time arrow <NUM>. At <NUM>, the host device <NUM> may send an initial counter value, such as <NUM>, over the authentication sideband channel (e.g., <NUM> of <FIG>). At <NUM>, the one or more I/Os (e.g., <NUM> of <FIG>) may be processed in a normal fashion, for example, without any disruption to the generation, flow, receipt, and processing of the I/Os. At <NUM>, the host device <NUM> may send an incremented counter value, such as <NUM>, over the authentication sideband channel to the storage device <NUM>. At <NUM>, the one or more I/Os may continue to be processed in a normal fashion, for example, without any disruption to the generation, flow, receipt, and processing of the I/Os. At <NUM>, the host device <NUM> may send an incremented counter value, such as <NUM>, over the authentication sideband channel to the storage device <NUM>. At <NUM>, the one or more I/Os may continue to be processed in a normal fashion, for example, without any disruption to the generation, flow, receipt, and processing of the I/Os. At <NUM>, the host device <NUM> may send an incremented counter value, such as <NUM>, over the authentication sideband channel to the storage device <NUM>. At <NUM>, the one or more I/Os may continue to be processed in a normal fashion, for example, without any disruption to the generation, flow, receipt, and processing of the I/Os. At <NUM> the host device <NUM> may send an incremented counter value, such as <NUM>, over the authentication sideband channel to the storage device <NUM>.

At <NUM>, the storage device <NUM> may stop processing the one or more I/Os because the chronological counter value of <NUM> was skipped or missing, which indicates that the sideband authentication channel <NUM> is possibly being tampered with. Alternatively or in addition, the storage device <NUM> may send one or more invalid signals (e.g., <NUM> of <FIG>) to the host device <NUM> in response to I/Os received from the host device <NUM> from that point (i.e., when detecting the skipped or missing chronological counter value) forward in time.

<FIG> is another example timing flow diagram <NUM> of the operation of the continuous authentication system (e.g., <NUM> of <FIG>) including a threshold timeout in accordance with some embodiments. The direction of time is shown by the time arrow <NUM>. At <NUM>, the host device <NUM> may send an initial counter value, such as <NUM>, over the authentication sideband channel (e.g., <NUM> of <FIG>). At <NUM>, the one or more I/Os (e.g., <NUM> of <FIG>) may be processed in a normal fashion, for example, without any disruption to the generation, flow, receipt, and processing of the I/Os. At <NUM>, the host device <NUM> may send an incremented counter value, such as <NUM>, over the authentication sideband channel to the storage device <NUM>. At <NUM>, the one or more I/Os may continue to be processed in a normal fashion, for example, without any disruption to the generation, flow, receipt, and processing of the I/Os. At <NUM>, the host device <NUM> may send an incremented counter value, such as <NUM>, over the authentication sideband channel to the storage device <NUM>. At <NUM>, the one or more I/Os may continue to be processed in a normal fashion, for example, without any disruption to the generation, flow, receipt, and processing of the I/Os. At <NUM>, the host device <NUM> may send an incremented counter value, such as <NUM>, over the authentication sideband channel to the storage device <NUM>. At <NUM>, the one or more I/Os may continue to be processed in a normal fashion, for example, without any disruption to the generation, flow, receipt, and processing of the I/Os.

At this point, the storage device <NUM> may stop receiving the incremented counter value, which may be an indication that the sideband authentication channel <NUM> is possibly being tampered with. After a timeout threshold <NUM> has transpired, the storage device <NUM> may stop processing the one or more I/Os at <NUM>, because of the indication that the sideband authentication channel <NUM> is possibly being tampered with. Alternatively or in addition, the storage device <NUM> may send one or more invalid signals (e.g., <NUM> of <FIG>) to the host device <NUM> in response to I/Os received from the host device <NUM> from that point (i.e., when the timeout threshold <NUM> is reached) forward in time.

<FIG> is an example diagram of a continuous authentication system <NUM> including a fiber sideband authentication channel <NUM> and a pixel <NUM> in accordance with some embodiments. Some components and reference numerals shown in <FIG> are described above, and an additional description is not necessarily repeated here. For additional signal barrier security, the sideband authentication channel <NUM> can use a fiber cable medium that receives a light signal representing the valid incrementing counter values. The host device <NUM> may include an optical signal generator <NUM> that may produce the light signal. A light signal receiving part may be implemented as a pixel <NUM> in the storage device <NUM>, as further described below. The pixel <NUM> may be part of or otherwise incorporated into the storage device <NUM>. In some embodiments, the pixel <NUM> may be part of or otherwise incorporated into a processor, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a storage enclosure, a storage chassis, a storage rack, combinations thereof, and/or the like.

<FIG> are example diagrams of storage devices (e.g., <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>) including a micro-lens in accordance with some embodiments. Reference is now made to <FIG>.

The storage devices (e.g., <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>) may include an SSD controller system on a chip (SOC). Some SSD controllers are produced using a flip-chip technology process, and may include a substrate (e.g., <NUM>). The SSD controller may include a back side illumination (BSI) complementary metal-oxide-semiconductor (CMOS) image sensor <NUM>, which may be implemented as a pixel (e.g., <NUM> of <FIG>). The BSI CMOS image sensor <NUM> may include a light receiving part, such as a micro-lens <NUM>. The BSI CMOS image sensor <NUM> may optionally include a color filter <NUM> between the substrate (e.g., <NUM>) and the light receiving part (e.g., <NUM>). The BSI CMOS image sensor <NUM> may not include the color filter <NUM>, as shown in <FIG>. The BSI CMOS image sensor <NUM> may detect a state of the authentication signal <NUM>.

The BSI CMOS image sensor <NUM> may be disposed on a back side of the substrate <NUM>. One or more metal layers (e.g., <NUM>, <NUM>) and one or more P or N wells <NUM> may be disposed on a front side of the substrate <NUM>. The storage devices (e.g., <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>) may be coupled to a printed circuit board <NUM> or other suitable pad using solder bumps (e.g., <NUM>, <NUM>).

One advantage of this approach is that the valid counter values can be made and/or detected using CMOS technology, for example, using an SSD controller SOC. Since some SSD controllers use a flip-chip technology process, the pixel can be made in a back side of substrate.

<FIG> is an example diagram of a continuous authentication system <NUM> including an SSD controller <NUM> and an image sensor <NUM> in accordance with some embodiments. The SSD controller <NUM> may include the decryption unit <NUM>. The decryption unit <NUM> may include a BSI CMOS image sensor <NUM>. The BSI CMOS image sensor <NUM> may include a charge pump <NUM> and an analog-to-digital converter (ADC) <NUM>. Since the pixel <NUM> is not for a visualized image-like picture, the disclosed system <NUM> may not need a color filter. The pixel <NUM> may generate a charge electron when the light signal arrives, and the pixel <NUM> can be sampled by the charge pump <NUM> and the ADC <NUM>, for example. In this manner, the SSD controller <NUM> can determine the incrementing integer value (e.g., <NUM>) from the received light signal. In an alternative embodiment, Inter-Integrated Circuit (I<NUM>C) can be used instead to transmit, carry, or receive the incrementing integer value, and/or in combination with the embodiments disclosed above.

<FIG> is an example diagram of a continuous authentication system <NUM> including a storage enclosure <NUM> in accordance with some embodiments. The storage device (e.g., <NUM> of <FIG>) may further include one or more storage enclosures <NUM>. The one or more storage enclosures <NUM> may include one or more SSD controllers <NUM>. The one or more storage enclosures <NUM> may include the decryption unit <NUM>. The decryption unit <NUM> may be associated with each of the one or more SSD controllers <NUM> of the one or more storage enclosures <NUM>. In this manner, all of the one or more storage enclosures <NUM> may be continuously authenticated using a single decryption unit <NUM>. When the second physical connection <NUM> is tampered with, the I/Os associated with all of the one or more storage enclosures <NUM> may be stopped, and invalid responses returned to the host device <NUM>.

<FIG> is an example diagram of a continuous authentication system <NUM> including a storage rack <NUM> in accordance with some embodiments. The storage device (e.g., <NUM> of <FIG>) may further include one or more storage racks <NUM>. The one or more storage racks <NUM> may include one or more storage enclosures (e.g., 1205a, 1205b). The one or more storage enclosures (e.g., 1205a, 1205b) may include one or more SSD controllers (e.g., <NUM>). The decryption unit <NUM> may be associated with each of the one or more SSD controllers <NUM> of the one or more storage enclosures (e.g., 1205a, 1205b) of the one or more storage racks <NUM>. In this manner, all of the one or more storage racks <NUM> may be continuously authenticated using a single decryption unit <NUM>. When the second physical connection <NUM> is tampered with, all I/Os associated with all of the one or more storage racks <NUM> may be stopped, and invalid responses returned to the host device <NUM>.

<FIG> is a flow diagram <NUM> showing a technique for operating the continuous authentication system including monitoring a gradually incrementing chronological counter value in accordance with some embodiments. At <NUM>, the host device (e.g., <NUM> of <FIG>) may generate a gradually incrementing chronological counter value. For example, the incrementing chronological counter may be periodically incrementing or generated at a predetermined rate. At <NUM>, the storage device (e.g., <NUM> of <FIG>) may receive the counter value. At <NUM>, the storage device can determine whether the counter value that was received is incrementing (e.g., gradually incrementing) and chronological. When the storage device determines that the counter value that was received is incrementing and chronological, then the flow can proceed to <NUM>. At <NUM>, the storage device can process I/Os normally, after which the flow can return to <NUM>. Otherwise, when the storage device determines that the counter value that was received is either not incrementing or not chronological, or both, then the flow can proceed to <NUM>. At <NUM>, the storage device can stop processing the I/Os and/or return one or more invalid signals to the host device in response to future requests from the host device.

<FIG> is a flow diagram showing a technique for operating the continuous authentication system including monitoring for a threshold timeout of the counter value in accordance with some embodiments. At <NUM>, the host device (e.g., <NUM> of <FIG>) may generate a gradually incrementing chronological counter value. For example, the incrementing chronological counter may be periodically incrementing or generated at a predetermined rate. At <NUM>, the storage device (e.g., <NUM> of <FIG>) may receive the counter value. At <NUM>, the storage device can determine whether the counter value has not been received after threshold amount of time. When the storage device determines that the counter value has not been received after a threshold amount of time, then the flow can proceed to <NUM>. At <NUM>, the storage device can stop processing the I/Os and/or return one or more invalid signals to the host device in response to future requests from the host device. Otherwise, when the storage device determines at <NUM> that the counter value has been received within the threshold amount of time, then the flow can proceed to <NUM>. At <NUM>, the storage device can process I/Os normally, after which the flow can return to <NUM>.

Some embodiments of the disclosure may include a method for continuously authenticating a storage device. The method can include generating, by a host device, a gradually incrementing chronological counter value. The method can include receiving, by a storage device, the counter value. The method can include determining, by the storage device, whether the received counter value is gradually incrementing and chronological. In response to determining by the storage device that the received counter value is gradually incrementing and chronological, the method can include processing one or more input/outputs (I/Os). In response to determining by the storage device that the received counter value is at least one of a) not gradually incrementing or b) non-chronological, the method can include stopping processing the one or more I/Os.

Some embodiments include a method for continuously authenticating a storage device. The method can include generating, by a host device, a gradually incrementing chronological counter value. The method can include receiving, by a storage device, the counter value. The method can include determining, by the storage device, whether the counter value is received after a threshold amount of time. In response to determining by the storage device that the received counter value is received within the threshold amount of time, the method can include processing one or more input/outputs (I/Os). In response to determining by the storage device that the received counter value is after the threshold amount of time, the method can include stopping processing the one or more I/Os.

The various operations of methods described above may be performed by any suitable means capable of performing the operations, such as various hardware and/or software component(s), circuits, and/or module(s).

The blocks or steps of a method or algorithm and functions described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a tangible, non-transitory computer-readable medium. A software module may reside in Random Access Memory (RAM), flash memory, Read Only Memory (ROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD ROM, or any other form of storage medium known in the art.

The following discussion is intended to provide a brief, general description of a suitable machine or machines in which certain aspects of the inventive concept can be implemented. Typically, the machine or machines include a system bus to which is attached processors, memory, e.g., RAM, ROM, or other state preserving medium, storage devices, a video interface, and input/output interface ports. The machine or machines can be controlled, at least in part, by input from conventional input devices, such as keyboards, mice, etc., as well as by directives received from another machine, interaction with a virtual reality (VR) environment, biometric feedback, or other input signal. As used herein, the term "machine" is intended to broadly encompass a single machine, a virtual machine, or a system of communicatively coupled machines, virtual machines, or devices operating together. Exemplary machines include computing devices such as personal computers, workstations, servers, portable computers, handheld devices, telephones, tablets, etc., as well as transportation devices, such as private or public transportation, e.g., automobiles, trains, cabs, etc..

The machine or machines can include embedded controllers, such as programmable or non-programmable logic devices or arrays, Application Specific Integrated Circuits (ASICs), embedded computers, smart cards, and the like. The machine or machines can utilize one or more connections to one or more remote machines, such as through a network interface, modem, or other communicative coupling. Machines can be interconnected by way of a physical and/or logical network, such as an intranet, the Internet, local area networks, wide area networks, etc. One skilled in the art will appreciate that network communication can utilize various wired and/or wireless short range or long range carriers and protocols, including radio frequency (RF), satellite, microwave, Institute of Electrical and Electronics Engineers (IEEE) <NUM>, Bluetooth®, optical, infrared, cable, laser, etc..

Embodiments of the present disclosure can be described by reference to or in conjunction with associated data including functions, procedures, data structures, application programs, etc. which when accessed by a machine results in the machine performing tasks or defining abstract data types or low-level hardware contexts. Associated data can be stored in, for example, the volatile and/or non-volatile memory, e.g., RAM, ROM, etc., or in other storage devices and their associated storage media, including hard-drives, floppy-disks, optical storage, tapes, flash memory, memory sticks, digital video disks, biological storage, etc. Associated data can be delivered over transmission environments, including the physical and/or logical network, in the form of packets, serial data, parallel data, propagated signals, etc., and can be used in a compressed or encrypted format. Associated data can be used in a distributed environment, and stored locally and/or remotely for machine access.

Having described and illustrated the principles of the present disclosure with reference to illustrated embodiments, it will be recognized that the illustrated embodiments can be modified in arrangement and detail without departing from such principles, and can be combined in any desired manner. And although the foregoing discussion has focused on particular embodiments, other configurations are contemplated. In particular, even though expressions such as "according to an embodiment of the inventive concept" or the like are used herein, these phrases are meant to generally reference embodiment possibilities, and are not intended to limit the inventive concept to particular embodiment configurations. As used herein, these terms can reference the same or different embodiments that are combinable into other embodiments.

Embodiments of the present disclosure may include a non-transitory machine-readable medium comprising instructions executable by one or more processors, the instructions comprising instructions to perform the elements of the inventive concepts as described herein.

Claim 1:
A continuous authentication system (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>), comprising:
a host (<NUM>) including an encryption unit (<NUM>);
a storage device (<NUM>) including a decryption unit (<NUM>);
a first physical connection (<NUM>) between the host (<NUM>) and the storage device (<NUM>), wherein the first physical connection (<NUM>) is configured to transfer one or more input/output requests, I/Os; and
a second physical connection (<NUM>) between the host (<NUM>) and the storage device (<NUM>), wherein:
the encryption unit (<NUM>) is configured to encrypt an authentication signal (<NUM>);
the host (<NUM>) is configured to transmit the encrypted authentication signal (<NUM>) through the second physical connection (<NUM>);
the storage device (<NUM>) is configured to receive the encrypted authentication signal (<NUM>) through the second physical connection (<NUM>); and
the decryption unit (<NUM>) is configured to decrypt the encrypted authentication signal (<NUM>),
wherein the authentication signal (<NUM>) includes a periodically incrementing integer value,
wherein the storage device (<NUM>) is configured to stop processing the one or more I/Os in response to the periodically incrementing integer value having a non-chronological increment.