Seagate ST500NM0051, ST2000NM0031 Data Encryption, Controlled Access, Random Number Generator RNG

Page 32

5.0ABOUT SELF-ENCRYPTING DRIVES

Self-encrypting drives (SEDs) offer encryption and security services for the protection of stored data, commonly known as “protection of data at rest.” These drives are compliant with the Trusted Computing Group (TCG) Enterprise Storage Specifications as detailed in Section 2.17.

The Trusted Computing Group (TCG) is an organization sponsored and operated by companies in the computer, storage and digital communications industry. Seagate’s SED models comply with the standards published by the TCG.

To use the security features in the drive, the host must be capable of constructing and issuing the following two ATA commands:

•Trusted Send

•Trusted Receive

These commands are used to convey the TCG protocol to and from the drive in their command payloads.

5.1DATA ENCRYPTION

Encrypting drives use one inline encryption engine for each port, employing AES-256 data encryption in Cipher Block Chaining (CBC) mode to encrypt all data prior to being written on the media and to decrypt all data as it is read from the media. The encryption engines are always in operation and cannot be disabled.

The 32-byte Data Encryption Key (DEK) is a random number which is generated by the drive, never leaves the drive, and is inaccessible to the host system. The DEK is itself encrypted when it is stored on the media and when it is in volatile temporary storage (DRAM) external to the encryption engine. A unique data encryption key is used for each of the drive's possible16 data bands (see Section 5.5).

5.2CONTROLLED ACCESS

The drive has two security providers (SPs) called the "Admin SP" and the "Locking SP." These act as gatekeepers to the drive security services. Security-related commands will not be accepted unless they also supply the correct credentials to prove the requester is authorized to perform the command.

5.2.1Admin SP

The Admin SP allows the drive's owner to enable or disable firmware download operations (see Section 5.4). Access to the Admin SP is available using the SID (Secure ID) password or the MSID (Manufacturers Secure ID) password.

5.2.2Locking SP

The Locking SP controls read/write access to the media and the cryptographic erase feature. Access to the Locking SP is available using the BandMasterX or EraseMaster passwords. Since the drive owner can define up to 16 data bands on the drive, each data band has its own password called BandMasterX where X is the number of the data band (0 through 15).

5.2.3Default password

When the drive is shipped from the factory, all passwords are set to the value of MSID. This 32-byte random value can only be read by the host electronically over the interface. After receipt of the drive, it is the responsibility of the owner to use the default MSID password as the authority to change all other passwords to unique owner-specified values.

5.3RANDOM NUMBER GENERATOR (RNG)

The drive has a 32-byte hardware RNG that it is uses to derive encryption keys or, if requested to do so, to provide random numbers to the host for system use, including using these numbers as Authentication Keys (passwords) for the drive’s Admin and Locking SPs.

CONSTELLATION ES SERIAL ATA PRODUCT MANUAL, REV. F

27

Page 31 Page 33
Image 32
Page 31 Page 33
Contents Constellation ES Serial ATA Document Revision History Contents Serial ATA Sata interface Figures Seagate Technology Support Services Introduction About the Serial ATA Interface Drive Specifications Specification Summary TablesLBA mode Formatted CapacityDefault Logical Geometry Physical CharacteristicsRecording and Interface Technology Seek TimePower Specifications Power consumptionSTART/STOP Times 2TB models 1TB models 500GB models2TB Drive DC power requirements 1TB Drive DC power requirements 500GB Drive DC power requirements Typical current profiles 2TB model current profile 1TB model current profile 500GB model current profile Voltage tolerancePower-management modes Power modes Heads Spindle BufferActive mode Standby modeExtended Power Conditions PowerChoiceTM Power Condition Name Power Condition ID DescriptionPowerChoice is invoked using one of two methods A.R.T. Read Data ReportsPower Condition Identifiers Power Condition Name Power Condition Name Manufacturer Default Timer ValuesPowerChoice Supported Extended Power Condition Identifiers Temperature a. Operating Environmental LimitsHumidity Relative humidity AltitudeShock Operating shockAcoustics Fluid Dynamic Bearing FDB motor acousticsTest for Prominent Discrete Tones Pdts Electromagnetic ImmunitySafety certification ReliabilityAgency Certification Electromagnetic compatibilityFCC verification Korean RRLAustralian C-Tick N176 Corrosive Environment Environmental ProtectionChina Restriction of Hazardous Substances RoHS Directive Product Warranty Reference DocumentsShipping StorageSerial ATA Cables and Connectors Handling and STATIC-DISCHARGE PrecautionsConfiguring the Drive Mounting dimensions-top, side and end view Drive MountingLevel 2 security PurposeSeagate Enterprise SEDs Random Number Generator RNG Controlled AccessData Encryption Authenticated Firmware Download Power RequirementsSupported Commands Drive LockingATA Security Erase Unit Command on SED Sata Drives RevertspHOT-PLUG Compatibility Serial ATA Device Plug Connector PIN DefinitionsSerial ATA connector pin definitions Supported ATA Commands Command name Command code in hexCA H Identify Device command Word Description ValueXx 3F H Description if bit is set to Set Features command Set Features command values3 S.M.A.R.T. commands M.A.R.T. commandsIndex Psid RNG Index Seagate Technology LLC
Top Page Image Contents