Seagate ST2000NM0063 manual About SELF-ENCRYPTING Drives, Admin SP, Locking SP, Default password

Page 42

8.0ABOUT SELF-ENCRYPTING DRIVES

Self-encrypting drives (SEDs) offer encryption and security services for the protection of stored data, commonly known as “protection of data at rest.” These drives are compliant with the Trusted Computing Group (TCG) Enterprise Storage Specifications as detailed in Section 2.2.

The Trusted Computing Group (TCG) is an organization sponsored and operated by companies in the computer, storage and digital communications industry. Seagate’s SED models comply with the standards published by the TCG.

To use the security features in the drive, the host must be capable of constructing and issuing the following two SCSI commands:

•Security Protocol Out

•Security Protocol In

These commands are used to convey the TCG protocol to and from the drive in their command payloads.

8.1DATA ENCRYPTION

Encrypting drives use one inline encryption engine for each port, employing AES-256 data encryption in Cipher Block Chaining (CBC) mode to encrypt all data prior to being written on the media and to decrypt all data as it is read from the media. The encryption engines are always in operation and cannot be disabled.

The 32-byte Data Encryption Key (DEK) is a random number which is generated by the drive, never leaves the drive, and is inaccessible to the host system. The DEK is itself encrypted when it is stored on the media and when it is in volatile temporary storage (DRAM) external to the encryption engine. A unique data encryption key is used for each of the drive's possible16 data bands (see Section 8.5).

8.2CONTROLLED ACCESS

The drive has two security providers (SPs) called the "Admin SP" and the "Locking SP." These act as gatekeepers to the drive security services. Security-related commands will not be accepted unless they also supply the correct credentials to prove the requester is authorized to perform the command.

8.2.1Admin SP

The Admin SP allows the drive's owner to enable or disable firmware download operations (see Section 8.4). Access to the Admin SP is available using the SID (Secure ID) password or the MSID (Manufacturers Secure ID) password.

8.2.2Locking SP

The Locking SP controls read/write access to the media and the cryptographic erase feature. Access to the Locking SP is available using the BandMasterX or EraseMaster passwords. Since the drive owner can define up to 16 data bands on the drive, each data band has its own password called BandMasterX where X is the number of the data band (0 through 15).

8.2.3Default password

When the drive is shipped from the factory, all passwords are set to the value of MSID. This 32-byte random value can only be read by the host electronically over the interface. After receipt of the drive, it is the responsibility of the owner to use the default MSID password as the authority to change all other passwords to unique owner-specified values.

8.3RANDOM NUMBER GENERATOR (RNG)

The drive has a 32-byte hardware RNG that it is uses to derive encryption keys or, if requested to do so, to provide random numbers to the host for system use, including using these numbers as Authentication Keys (passwords) for the drive’s Admin and Locking SPs.

8.4DRIVE LOCKING

In addition to changing the passwords, as described in Section 8.2.3, the owner should also set the data access controls for the individual bands.

The variable "LockOnReset" should be set to "PowerCycle" to ensure that the data bands will be locked if power is lost. In addition "ReadLockEnabled" and "WriteLockEnabled" must be set to true in the locking table in order for the bands "LockOnReset" setting of "PowerCycle" to actually lock access to the band when a "PowerCycle" event occurs. This scenario occurs if the drive is removed from its cabinet. The drive will not honor any data read or write requests until the bands have been unlocked. This prevents the user data from being accessed without the appropriate credentials when the drive has been removed from its cabinet and installed in another system. When the drive is shipped from the factory, the firmware download port is unlocked

CONSTELLATION ES.1 SAS PRODUCT MANUAL, REV. G

36

Page 41 Page 43
Image 42
Page 41 Page 43
Contents Constellation ES.1 SAS Document Revision History Contents Installation Inquiry data 11.3.2 Mode Sense data Figures Seagate Technology Support Services Scope Model Number Self-Encrypting Drive SED Fips 140-2 LevelApplicable Standards and Reference Documentation European Union Restriction of Hazardous Substances RoHS Korean KCCTaiwanese Bsmi China Restriction of Hazardous Substances RoHS DirectiveSAS Interface Manual General Description Standard Features DDADF508 Full stroke Performance CharacteristicsRead Write Average Single track Maximum without verifyGeneral performance characteristics Caching write data Prefetch operationUnrecoverable Errors Reliability SpecificationsRecoverable Errors Seek errorsPreventive maintenance Hot plugging the drivePerformance impact 4 S.M.A.R.TControlling S.M.A.R.T Reporting controlDrive Self Test DST Thermal monitorParameter Code Description DST failure definitionInvoking DST State of the drive prior to testingImplementation Short and extended testsShipping Product warrantyAbort StoragePHYSICAL/ELECTRICAL Specifications 2TB drive Standard & SED model DC power requirements 0Gb mode Amps1TB drive Standard & SED model DC power requirements 500GB drive Standard & SED model DC power requirements Power sequencing Conducted noise immunityCurrent profiles TB model current profiles GB model current profiles Power Dissipation Constellation ES.1 SAS Product MANUAL, REV. G Constellation ES.1 SAS Product MANUAL, REV. G Constellation ES.1 SAS Product MANUAL, REV. G Constellation ES.1 SAS Product MANUAL, REV. G Constellation ES.1 SAS Product MANUAL, REV. G Effective altitude sea level a. Operating Temperature a. OperatingRelative humidity Shock and vibrationPackage size Packaged/product weight Drop height ShockAcoustics Air cleanlinessVibration Corrosive environmentWeight maximum Mounting configuration dimensionsPurpose Validation ProgramSeagate Enterprise SED About SELF-ENCRYPTING Drives Admin SPDefault password Locking SPSanitize Cryptographic Erase Defect and Error Management Drive Internal DEFECTS/ERRORSRead and write retry count maximum recovery times Setting and determining the current Type Level Levels of PIIdentifying a Protection Information drive Installation Physical interfaceX = F 15lb = 67N SAS task management functions supported Interface RequirementsTask management functions Task management responsesSupported commands Command name Command code SupportedSupported commands Supported commands Supported commands Inquiry data Mode Sense data Mode Pages Mode Sense data changeable and default values for 1TB drives Mode Pages Miscellaneous status Miscellaneous featuresSupported Feature or condition Supported StatusDatum B Section C C Section a a Pin Signal name Signal type Physical characteristicsConnector requirements Electrical descriptionReady LED Out PowerSAS transmitters and receivers Ready LED Out conditionsLED drive signal Differential signalsGeneral interface characteristics Index Latency Index SAS Seagate Technology LLC

ST2000NM0063 specifications

The Seagate ST2000NM0063 is a high-performance internal hard disk drive designed for enterprise environments, offering a robust solution for those requiring reliable data storage. With a storage capacity of 2TB, this drive is ideal for both small and large enterprises, catering to applications ranging from data centers to surveillance systems.

One of the main features of the ST2000NM0063 is its 7200 RPM rotational speed, which ensures rapid data access and improved overall performance. This speed allows for faster read and write times, making it suitable for applications that demand quick data retrieval and processing. The drive supports a SATA 6Gb/s interface, which provides enhanced data transfer rates. This modern interface is essential for maximizing throughput, particularly when deployed in environments where speed is critical.

In terms of technology, the Seagate ST2000NM0063 utilizes Advanced Format Technology, enhancing data storage efficiency and increasing the number of user-addressable sectors. This feature allows for better alignment of data on the drive, which can lead to improved performance and reliability. Additionally, the drive incorporates the Seagate PowerChoice technology, enabling energy-efficient operations. This technology helps reduce power consumption during idle periods, contributing to lower operating costs and a smaller carbon footprint.

The ST2000NM0063 also emphasizes data integrity and reliability. Equipped with features such as error recovery control and vibration tolerance, this drive is designed to operate in challenging conditions. These attributes make it an excellent choice for RAID configurations and other enterprise applications that require high data availability and protection against data loss.

Furthermore, the ST2000NM0063 has a mean time between failures (MTBF) rating of 1.2 million hours, signifying its durability and long lifespan. This reliability is crucial for critical business applications where downtime is not an option.

In summary, the Seagate ST2000NM0063 combines high capacity, excellent performance, and advanced technologies to meet the demanding needs of enterprise storage. Its reliability, efficiency, and robust features make it a preferred choice for organizations looking to enhance their data storage solutions while ensuring optimal performance and longevity. Whether utilized in cloud storage, surveillance, or data center applications, this hard drive stands out as a dependable component in any IT infrastructure.
Top Page Image Contents