Seagate 100516226, ST3300457SS About SELF-ENCRYPTING Drives, Data Encryption, Controlled Access

Page 36

8.0ABOUT SELF-ENCRYPTING DRIVES

Self-encrypting drives (SEDs) offer encryption and security services for the protection of stored data, commonly known as “protection of data at rest.” These drives are compliant with the Trusted Computing Group (TCG) Enterprise Storage Specifications as detailed in Section 2.4.

The Trusted Computing Group (TCG) is an organization sponsored and operated by companies in the computer, storage and digital communications industry. Seagate’s SED models comply with the standards published by the TCG.

To use the security features in the drive, the host must be capable of constructing and issuing the following two SCSI commands:

•Security Protocol Out

•Security Protocol In

These commands are used to convey the TCG protocol to and from the drive in their command payloads.

8.1DATA ENCRYPTION

Encrypting drives use one inline encryption engine for each port, employing AES-128 data encryption in Cipher Block Chaining (CBC) mode to encrypt all data prior to being written on the media and to decrypt all data as it is read from the media. The encryption engines are always in operation, cannot be disabled, and do not detract in any way from the performance of the drive.

The 32-byte Data Encryption Key (DEK) is a random number which is generated by the drive, never leaves the drive, and is inaccessible to the host system. The DEK is itself encrypted when it is stored on the media and when it is in volatile temporary storage (DRAM) external to the encryption engine. A unique data encryption key is used for each of the drive's possible16 data bands (see Section 8.5).

8.2CONTROLLED ACCESS

The drive has two security partitions (SPs) called the "Admin SP" and the "Locking SP." These act as gatekeepers to the drive security services. Security-related commands will not be accepted unless they also supply the correct credentials to prove the requester is authorized to perform the command.

8.2.1Admin SP

The Admin SP allows the drive's owner to enable or disable firmware download operations (see Section 8.4). Access to the Admin SP is available using the SID (Secure ID) password or the MSID (Makers Secure ID) password.

8.2.2Locking SP

The Locking SP controls read/write access to the media and the cryptographic erase feature. Access to the Locking SP is available using the BandMasterX or EraseMaster passwords. Since the drive owner can define up to 16 data bands on the drive, each data band has its own password called BandMasterX where X is the number of the data band (0 through 15).

8.2.3Default password

When the drive is shipped from the factory, all passwords are set to the value of MSID. This 32-byte random value is printed on the drive label and it can be read by the host electronically over the I/O. After receipt of the drive, it is the responsibility of the owner to use the default MSID password as the authority to change all other passwords to unique owner-specified values.

8.3RANDOM NUMBER GENERATOR (RNG)

The drive has a 32-byte hardware RNG that it is uses to derive encryption keys or, if requested to do so, to provide random numbers to the host for system use, including using these numbers as Authentication Keys (passwords) for the drive’s Admin and Locking SPs.

CHEETAH 15K.7 SAS PRODUCT MANUAL, REV. F

31

Page 35 Page 37
Image 36
Page 35 Page 37
Contents Standard models Self-Encrypting Drive models SED Fips 140-2 modelsPage Contents Defect and Error Management InstallationAbout Fips About SELF-ENCRYPTING Drives Interface RequirementsCheetah 15K.7 SAS Product MANUAL, REV. F III Seagate Technology Support Services Scope Fips 140-2 L EvelSED STANDARDS, Compliance and Reference Documents StandardsCompliance Australian C-Tick Korean KCCTaiwanese Bsmi European Union Restriction of Hazardous Substances RohsGeneral Description Standard Features Media DescriptionPerformance FACTORY-INSTALLED Options ReliabilityFormatted Capacities ST3600057SS ST3450857SS ST3300657FCPerformance Characteristics Internal Drive CharacteristicsAccess time Format command execution time minutesGeneral performance characteristics START/STOP TimePREFETCH/MULTI-SEGMENTED Cache Control Cache Operation Caching write data Prefetch operationReliability Specifications Error RatesReliability and Service Preventive maintenance Hot plugging the drive4 S.M.A.R.T Controlling S.M.A.R.TPerformance impact MillisecondsReporting control Determining rateTemperature Log Page 0Dh Parameter Code DescriptionDrive Self Test DST DST failure definitionState of the drive prior to testing ImplementationInvoking DST Short and extended testsProduct warranty Log page entriesAbort ShippingPHYSICAL/ELECTRICAL Specifications AC Power RequirementsDC Power Requirements 600 GB DC power requirements450 GB DC power requirements 300 GB DC power requirements Power sequencing Conducted noise immunityCurrent profiles Typical 450GB current profiles Power Dissipation Temperature a. Operating 300GB modelEnvironmental Limits Relative humidity Effective altitude sea level a. OperatingShock and vibration ShockVibration Recommended mountingAir cleanliness AcousticsCorrosive environment RoHS compliance statementMechanical Specifications Units of Measure mm inchesPurpose Validation ProgramSeagate Enterprise SED Controlled Access About SELF-ENCRYPTING DrivesData Encryption Random Number Generator RNGAuthenticated Firmware Download Power RequirementsSupported Commands Drive LockingDefect and Error Management Drive Internal DEFECTS/ERRORSDrive Error Recovery Procedures SAS System Errors Read and write retry count maximum recovery timesBackground Media Scan Media PRE-SCANDeferred AUTO-REALLOCATION Idle Read After WriteInstallation Drive OrientationCooling Drive Mounting GroundingSAS Features Interface RequirementsTask management functions Task management responsesScsi Commands Supported Commands supported by Cheetah 15K.7 SAS family drivesCommands supported by Cheetah 15K.7 SAS family drives Commands supported by Cheetah 15K.7 SAS family drives Mode Sense data Inquiry dataCheetah 15K.7 inquiry data Cheetah 15K.7 SAS Product MANUAL, REV. F 11.3.2.1 600GBmodel Mode Sense data 11.3.2.2 450GB model Mode Sense data 11.3.2.3 300GB model Mode Sense data Miscellaneous Operating Features and Conditions Supported Feature or conditionMiscellaneous features SAS physical interfaceDatum B This Area Physical characteristics Connector requirementsElectrical description Pin descriptionsPower Signal CharacteristicsSAS transmitters and receivers Ready LED OutDifferential signals SAS-2 Specification ComplianceBPS Additional InformationIndex Page SAS See also cooling Seagate Technology LLC Americas
Related manuals
Manual 76 pages 20.21 Kb Manual 76 pages 46.69 Kb
Top Page Image Contents