Seagate ST3600957SS About self-encrypting drives, Data encryption, Controlled access, Admin SP

Page 40

7.0About self-encrypting drives

Self-encrypting drives (SEDs) offer encryption and security services for the protection of stored data, com- monly known as “protection of data at rest.” These drives are compliant with the Trusted Computing Group (TCG) Enterprise Storage Specifications as detailed in Section 2.4.

The Trusted Computing Group (TCG) is an organization sponsored and operated by companies in the com- puter, storage and digital communications industry. Seagate’s SED models comply with the standards pub- lished by the TCG.

To use the security features in the drive, the host must be capable of constructing and issuing the following two SCSI commands:

•Security Protocol Out

•Security Protocol In

These commands are used to convey the TCG protocol to and from the drive in their command payloads.

7.1Data encryption

Encrypting drives use one inline encryption engine for each port, employing AES-128 data encryption in Cipher Block Chaining (CBC) mode to encrypt all data prior to being written on the media and to decrypt all data as it is read from the media. The encryption engines are always in operation, cannot be disabled, and do not detract in any way from the performance of the drive.

The 32-byte Data Encryption Key (DEK) is a random number which is generated by the drive, never leaves the drive, and is inaccessible to the host system. The DEK is itself encrypted when it is stored on the media and when it is in volatile temporary storage (DRAM) external to the encryption engine. A unique data encryption key is used for each of the drive's possible16 data bands (see Section 7.5).

7.2Controlled access

The drive has two security partitions (SPs) called the "Admin SP" and the "Locking SP." These act as gate- keepers to the drive security services. Security-related commands will not be accepted unless they also supply the correct credentials to prove the requester is authorized to perform the command.

7.2.1Admin SP

The Admin SP allows the drive's owner to enable or disable firmware download operations (see Section 7.4). Access to the Admin SP is available using the SID (Secure ID) password or the MSID (Makers Secure ID) password.

7.2.2Locking SP

The Locking SP controls read/write access to the media and the cryptographic erase feature. Access to the Locking SP is available using the BandMasterX or EraseMaster passwords. Since the drive owner can define up to 16 data bands on the drive, each data band has its own password called BandMasterX where X is the number of the data band (0 through 15).

34

Cheetah 15K.7 SAS Product Manual, Rev. A

Page 39 Page 41
Image 40
Page 39 Page 41
Contents Cheetah 15K.7 SAS Standard models Self-Encrypting Drive modelsPage Contents Defect and error management InstallationAbout self-encrypting drives Interface requirementsSeagate Technology support services Cheetah 15K.7 SAS Product Manual, Rev. a Scope Model Number Capacity Self-Encrypting Drive SEDStandards, compliance and reference documents StandardsElectromagnetic compatibility Electromagnetic susceptibilityCompliance European Union Restriction of Hazardous Substances RoHSReference documents General description Media description Standard featuresPerformance Factory-installed options ReliabilityFormatted capacities Programmable drive capacityPerformance characteristics Internal drive characteristicsAccess time Seek timeGeneral performance characteristics Format command execution time minutesStart/stop time Prefetch/multi-segmented cache control Cache operationCaching write data Prefetch operationReliability specifications Error ratesRecoverable Errors Unrecoverable ErrorsReliability and service Seek errorsInterface errors Preventive maintenance4 S.M.A.R.T Controlling S.M.A.R.TPerformance impact MillisecondsReporting control Determining ratePredictive failures Thermal monitorTemperature Log Page 0Dh Parameter Code Description State of the drive prior to testingDrive Self Test DST DST failure definitionInvoking DST Short and extended testsShort test Function Code 001b Extended test Function Code 010bProduct warranty AbortShipping Product repair and return informationAC power requirements Physical/electrical specificationsDC power requirements 600 GB DC power requirements ST3600057SS ST3600957SS Gbit mode Amps450 GB DC power requirements ST3450857SS ST3450757SS Gbit mode Amps300 GB DC power requirements ST3300657SS ST3300557SS Gbit mode AmpsConducted noise immunity Power sequencingCurrent profiles Typical 600GB current profiles Typical 300GB current profiles Power dissipation ST3600057SS modelST3450857SS model Environmental limits TemperatureST3300657SS model Relative humidity Effective altitude sea levelShock and vibration ShockPackage size Packaged/product weight Drop height Vibration Recommended mountingAir cleanliness AcousticsCorrosive environment RoHS compliance statementMechanical specifications Physical dimensionsControlled access Admin SPAbout self-encrypting drives Data encryptionAuthenticated firmware download Random number generator RNGDrive locking Data bandsPower requirements Supported commandsDrive internal defects/errors Defect and error managementDrive error recovery procedures Page SAS system errors Background Media ScanDeferred Auto-Reallocation Media Pre-ScanIdle Read After Write Drive orientation InstallationCooling Drive mounting GroundingSAS features Interface requirementsScsi commands supported Commands supported by Cheetah 15K.6 SAS family drivesCommand name Command code Supported Dual port supportCommands supported by Cheetah 15K.6 SAS family drives Commands supported by Cheetah 15K.6 SAS family drives Commands supported by Cheetah 15K.6 SAS family drives Inquiry data Cheetah 15K.7 inquiry data Bytes Data hexMode Sense data 10.3.2.1 ST3600057SS and ST3600957SS Mode Sense data Mode PagesDEF CHG 10.3.2.2 ST3450857SS and ST3450757SS Mode Sense data Mode Data Header Block Descriptor Mode PagesDEF CHG Read Capacity Data Buffer C D E F 10.3.2.3 ST3300657SS and ST3300557SS Mode Sense data Mode PagesMiscellaneous operating features and conditions Miscellaneous featuresSupported Feature or condition Miscellaneous statusSAS physical interface Physical interfaceDatum B Physical characteristics Connector requirementsPin Signal name Signal type Electrical descriptionPin descriptions SAS pin descriptionsSignal characteristics PowerSAS transmitters and receivers Ready LED OutSAS-2 Specification compliance LED drive signalDifferential signals General interface characteristicsPresales Support Seagate Technology support servicesTechnical Support Data Recovery Services Authorized Service Centers Warranty ServiceData Recovery Services Call CenterToll-freeDirect dialFAX Cheetah 15K.7 SAS Product Manual, Rev. a Index NumericsPage SAS Smart
Related manuals
Manual 62 pages 52 Kb
Top Page Image Contents