Seagate ST973252SS About self-encrypting drives, Data encryption, Controlled access, Admin SP

Page 44

9.0About self-encrypting drives

Self-encrypting drives (SEDs) offer encryption and security services for the protection of stored data, com- monly known as “protection of data at rest.” These drives are compliant with the Trusted Computing Group (TCG) Enterprise Storage Specifications as detailed in Section 3.2.

The Trusted Computing Group (TCG) is an organization sponsored and operated by companies in the com- puter, storage and digital communications industry. Seagate’s SED models comply with the standards pub- lished by the TCG.

To use the security features in the drive, the host must be capable of constructing and issuing the following two SCSI commands:

•Security Protocol Out

•Security Protocol In

These commands are used to convey the TCG protocol to and from the drive in their command payloads.

9.1Data encryption

Encrypting drives use one inline encryption engine for each port, employing AES-128 data encryption in Cipher Block Chaining (CBC) mode to encrypt all data prior to being written on the media and to decrypt all data as it is read from the media. The encryption engines are always in operation, cannot be disabled, and do not detract in any way from the performance of the drive.

The 32-byte Data Encryption Key (DEK) is a random number which is generated by the drive, never leaves the drive, and is inaccessible to the host system. The DEK is itself encrypted when it is stored on the media and when it is in volatile temporary storage (DRAM) external to the encryption engine. A unique data encryption key is used for each of the drive's possible16 data bands (see Section 9.5).

9.2Controlled access

The drive has two security partitions (SPs) called the "Admin SP" and the "Locking SP." These act as gate- keepers to the drive security services. Security-related commands will not be accepted unless they also supply the correct credentials to prove the requester is authorized to perform the command.

9.2.1Admin SP

The Admin SP allows the drive's owner to enable or disable firmware download operations (see Section 9.4). Access to the Admin SP is available using the SID (Secure ID) password or the MSID (Makers Secure ID) password.

36	Savvio 15K.2 SAS Product Manual, Rev. E

Image 44

Contents ST9146852SSST9146752SS ST973452SSST973352SS ST9146652SS ST973252SSStandard Models Self-Encrypting Drive Models SED Fips 140-2 ModelsPage Contents Defect and error management InstallationAbout Fips About self-encrypting drives Interface requirementsPage Savvio 15K.2 SAS Product Manual, Rev. E List of Figures Page Seagate Technology support services Seagate Online Support and ServicesScope Applicable standards and reference documentation StandardsElectromagnetic compatibility Electromagnetic susceptibilityElectromagnetic compliance Electromagnetic compliance for the European UnionAustralian C-Tick Korean MICReference documents European Union Restriction of Hazardous Substances RoHSGeneral description Standard features Media descriptionFormatted capacities PerformanceReliability Programmable drive capacity OptionsPerformance characteristics Internal drive characteristicsSeek performance characteristics Access timeStart/stop time Format command execution timeGeneral performance characteristics Prefetch/multi-segmented cache control Cache operationCaching write data Prefetch operationReliability specifications Error ratesRecoverable Errors Unrecoverable ErrorsReliability and service Seek errorsInterface errors Preventive maintenance4 S.M.A.R.T Controlling S.M.A.R.TPerformance impact Reporting controlThermal monitor Temperature Log Page 0Dh Parameter Code DescriptionPredictive failures State of the drive prior to testing Drive Self Test DSTDST failure definition ImplementationShort and extended tests Short test Function Code 001bExtended test Function Code 010b Log page entriesProduct repair and return information Product warrantyShipping DC power requirements Physical/electrical specificationsAC power requirements 146GB models DC power requirements Gbit mode Amps73GB models DC power requirements Conducted noise immunity General DC power requirement notesPower sequencing Current profiles Current profile for 146GB modelsCurrent profile for 73GB models 146GB models in 3.0 Gbit operation Power dissipation146GB models in 6.0 Gbit operation 73GB models in 6.0 Gbit operation 73GB models in 3.0 Gbit operationRelative humidity Temperature a. OperatingEnvironmental limits Shock Effective altitude sea level a. OperatingShock and vibration Recommended mounting Corrosive environment Air cleanlinessVibration a. Operating-normal Acoustics Mechanical specifications DimensionsLevel 2 security About FipsPurpose Controlled access Admin SPAbout self-encrypting drives Data encryptionDefault password Random number generator RNGDrive locking Data bandsAuthenticated firmware download Power requirementsSupported commands Cryptographic eraseDrive error recovery procedures Defect and error managementDrive internal defects/errors SAS system errors Deferred Auto-Reallocation Background Media ScanMedia Pre-Scan Idle Read After Write Installation Drive orientationCooling Air flowDrive mounting GroundingSAS features Interface requirementsDual port support Scsi commands supported Supported commandsSupported commands Supported commands Supported commands Savvio inquiry data Mode Sense dataInquiry data Page Mode Data Header 00 00 05 12 8B 00 10 Miscellaneous status Miscellaneous operating features and conditionsMiscellaneous features SAS physical interface Datum B Section C C Section a a Physical characteristics Connector requirementsElectrical description Pin descriptionsSAS pin descriptions SAS transmitters and receiversSignal characteristics Additional information SAS-2 Specification complianceGeneral interface characteristics Savvio 15K.2 SAS Product Manual, Rev. E Index NumericsIraw Msid Mtbf See also cooling