Seagate ST9500622NS About self-encrypting drives, Data encryption, Controlled access, Admin SP

Page 36

6.0About self-encrypting drives

Self-encrypting drives (SEDs) offer encryption and security services for the protection of stored data, com- monly known as “protection of data at rest.” These drives are compliant with the Trusted Computing Group (TCG) Enterprise Storage Specifications as detailed in Section 3.14.2.

The Trusted Computing Group (TCG) is an organization sponsored and operated by companies in the com- puter, storage and digital communications industry. Seagate’s SED models comply with the standards pub- lished by the TCG.

To use the security features in the drive, the host must be capable of constructing and issuing the following two commands:

•Security Protocol Out

•Security Protocol In

These commands are used to convey the TCG protocol to and from the drive in their command payloads.

6.1Data encryption

Encrypting drives use one inline encryption engine for each port, employing AES-256 data encryption in Cipher Block Chaining (CBC) mode to encrypt all data prior to being written on the media and to decrypt all data as it is read from the media. The encryption engines are always in operation, cannot be disabled, and do not detract in any way from the performance of the drive.

The 32-byte Data Encryption Key (DEK) is a random number which is generated by the drive, never leaves the drive, and is inaccessible to the host system. The DEK is itself encrypted when it is stored on the media and when it is in volatile temporary storage (DRAM) external to the encryption engine. A unique data encryption key is used for each of the drive's possible16 data bands (see Section 6.5).

6.2Controlled access

The drive has two security partitions (SPs) called the "Admin SP" and the "Locking SP." These act as gate- keepers to the drive security services. Security-related commands will not be accepted unless they also supply the correct credentials to prove the requester is authorized to perform the command.

6.2.1Admin SP

The Admin SP allows the drive's owner to enable or disable firmware download operations (see Section 6.4). Access to the Admin SP is available using the SID (Secure ID) password or the MSID (Makers Secure ID) password.

30

Constellation.2 Serial ATA Product Manual, Rev. B

Page 35 Page 37
Image 36
Page 35 Page 37
Contents ST91000642NS ST9500622NS ST9250612NS Standard Models Self-Encrypting Drive ModelsSED Fips 140-2 Models Revision history Revision Date Sheets affected or commentsContents Serial ATA Sata interface List of Figures Page Seagate Technology support services Seagate Online Support and ServicesIntroduction About the Serial ATA interface Drive specifications Specification summary tablesDrive specifications summary for 1TB, 500 and 250 GB models Constellation.2 Serial ATA Product Manual, Rev. B Default logical geometry LBA modeFormatted capacity Recording and interface technologyPhysical characteristics Seek timeStart/stop times Typical seek times ms Read WritePower specifications Power consumptionSpinup power Standby mode1000GB drive Standard & SED model DC power requirementss PowerST91000640NS Parameter 0GB Voltage +12 Regulation +10/-7.5% Watts500GB drive Standard & SED model DC power requirements ST9500620NS Parameter 0GB Voltage +12250GB drive Standard & SED model DC power requirements ST9250610NS Parameter 0GB Voltage +12Typical current profiles Conducted noise Voltage tolerancePower-management modes Active modeIdle mode Sleep modePowerChoice is invoked using one of two methods Power Condition Name Power Condition ID DescriptionTemperature a. Operating Environmental limitsRelative humidity Effective altitude sea level ShockOperating shock Nonoperating shockAcoustics VibrationOperating vibration Nonoperating vibrationElectromagnetic immunity ReliabilityRadio frequency environments Test Description Performance level Reference standardAgency certification Product warranty Environmental protectionReference documents Shipping StorageProduct repair and return information Corrosive environment China Restriction of Hazardous Substances RoHS DirectiveConfiguring and mounting the drive Handling and static-discharge precautionsConfiguring the drive Serial ATA cables and connectorsMounting dimensions-top, side and end view Drive mountingCooling Air flowAbout Fips PurposeLevel 2 security Controlled access Admin SPAbout self-encrypting drives Data encryptionDefault password Random number generator RNGDrive locking Data bandsAuthenticated firmware download Power requirementsSupported commands Cryptographic eraseSerial ATA Sata interface Hot-Plug compatibilitySerial ATA device plug connector pin definitions Serial ATA connector pin definitionsSignal Pin Function DefinitionSupported ATA commands Supported ATA commandsCommand name Command code in hex F4H Identify Device command Word Description ValueXx07H Description if bit is set to Bit Word Bit WordWord Set Features command Set Features command values3 S.M.A.R.T. commands A.R.T. commandsCode in features register A.R.T. command Index ITE Page Constellation.2 Serial ATA Product Manual, Rev. B Page Disc Drive, Scotts Valley, California 95066-4544, USA
Top Page Image Contents