Seagate ST35000415SS About self-encrypting drives, Data encryption, Controlled access, Admin SP

Page 49

7.0About self-encrypting drives

Self-encrypting drives (SEDs) offer encryption and security services for the protection of stored data, com- monly known as “protection of data at rest.” These drives are compliant with the Trusted Computing Group (TCG) Enterprise Storage Specifications as detailed in Section 2.2.

The Trusted Computing Group (TCG) is an organization sponsored and operated by companies in the com- puter, storage and digital communications industry. Seagate’s SED models comply with the standards pub- lished by the TCG.

To use the security features in the drive, the host must be capable of constructing and issuing the following two SCSI commands:

•Security Protocol Out

•Security Protocol In

These commands are used to convey the TCG protocol to and from the drive in their command payloads.

7.1Data encryption

Encrypting drives use one inline encryption engine for each port, employing AES-128 data encryption in Cipher Block Chaining (CBC) mode to encrypt all data prior to being written on the media and to decrypt all data as it is read from the media. The encryption engines are always in operation, cannot be disabled, and do not detract in any way from the performance of the drive.

The 32-byte Data Encryption Key (DEK) is a random number which is generated by the drive, never leaves the drive, and is inaccessible to the host system. The DEK is itself encrypted when it is stored on the media and when it is in volatile temporary storage (DRAM) external to the encryption engine. A unique data encryption key is used for each of the drive's possible16 data bands (see Section 7.5).

7.2Controlled access

The drive has two security partitions (SPs) called the "Admin SP" and the "Locking SP." These act as gate- keepers to the drive security services. Security-related commands will not be accepted unless they also supply the correct credentials to prove the requester is authorized to perform the command.

7.2.1Admin SP

The Admin SP allows the drive's owner to enable or disable firmware download operations (see Section 7.4). Access to the Admin SP is available using the SID (Secure ID) password or the MSID (Makers Secure ID) password.

ConstellationES Series SAS Product Manual, Rev. D

41

Page 48 Page 50
Image 49
Page 48 Page 50
Contents ST32000445SS ST31000425SS ST3500415SS ST32000444SS ST31000424SS ST3500414SSStandard Models Self-Encrypting Drive ModelsRevision history Contents Installation Defect and error managementAbout self-encrypting drives Interface requirementsSeagate Technology support services ConstellationES Series SAS Product Manual, Rev. D ST32000444SS & ST32000445SS model current profiles List of FiguresConstellationES Series SAS Product Manual, Rev. D Scope Standards Applicable standards and reference documentationElectromagnetic compatibility Electromagnetic susceptibilityElectromagnetic compliance for the European Union Electromagnetic complianceAustralian C-Tick Korean KCCEuropean Union Restriction of Hazardous Substances RoHS Reference documentsGeneral description Media description Standard featuresReliability PerformanceFormatted capacities Programmable drive capacityFactory-installed options Internal drive characteristics Performance characteristicsSeek performance characteristics Access timeStart/stop time General performance characteristicsCache operation Prefetch/multi-segmented cache controlPrefetch operation Caching write dataError rates Reliability specificationsRecoverable Errors Unrecoverable ErrorsSeek errors Reliability and serviceInterface errors Preventive maintenanceControlling S.M.A.R.T 4 S.M.A.R.TPerformance impact Reporting controlPredictive failures Temperature Log Page 0Dh Parameter Code DescriptionThermal monitor Drive Self Test DST State of the drive prior to testingDST failure definition ImplementationShort test Function Code 001b Short and extended testsExtended test Function Code 010b Log page entriesShipping Product warrantyProduct repair and return information PowerChoiceTM power management Physical/electrical specificationsPowerChoice modes DC power requirements AC power requirementsConstellationES Series SAS Product Manual, Rev. D ConstellationES Series SAS Product Manual, Rev. D Page Power sequencing General DC power requirement notesConducted noise immunity ST32000444SS & ST32000445SS model current profiles Current profilesST31000424SS & ST31000425SS model current profiles ST3500414SS & ST3500415SS model current profiles ST32000444SS and ST32000445SS in 3Gb operation Power dissipationST32000444SS and ST32000445SS in 6Gb operation ST31000424SS and ST31000425SS in 3Gb operation ST31000424SS and ST31000425SS in 6Gb operation ST3500414SS and ST3500415SS in 3Gb operation ST3500414SS CURRENT/POWER vs Throughput SAS 3.0GBOs per Second ST3500414SS and ST3500415SS in 6Gb operation Environmental limits Temperature a. OperatingRelative humidity Shock and vibration Effective altitude sea level a. OperatingShock Recommended mounting Vibration a. Operating-normal Air cleanlinessAcoustics Corrosive environmentElectromagnetic susceptibility Mounting configuration dimensions Mechanical specificationsAdmin SP Controlled accessAbout self-encrypting drives Data encryptionRandom number generator RNG Default passwordDrive locking Data bandsPower requirements Authenticated firmware downloadSupported commands Cryptographic eraseDrive internal defects/errors Defect and error managementDrive error recovery procedures SAS system errors Media Pre-Scan Background Media ScanDeferred Auto-Reallocation Idle Read After Write Drive orientation InstallationAir flow CoolingGrounding Drive mountingInterface requirements SAS featuresDual port support Supported commands Scsi commands supportedSupported commands Supported commands Supported commands Inquiry data Mode Sense dataConstellation ES inquiry data Page Mode Data Header 74 70 6d b0 00 00 02 3a 38 60 30 00 00 02 Miscellaneous features Miscellaneous operating features and conditionsMiscellaneous status SAS physical interface Datum B Section C C Section a a Connector requirements Physical characteristicsElectrical description Pin descriptionsPower Signal characteristicsSAS transmitters and receivers Ready LED OutLED drive signal SAS-2 Specification ComplianceDifferential signals General interface characteristicsWarranty Support Direct.seagate.com Spp.seagate.com Seagate Technology support servicesWeb Presales SupportData Recovery Services Authorized Service Centers Technical Support Warranty ServiceData Recovery Services Call Center Toll-free Direct dial Presales SupportNumerics IndexKCC Msid Mtbf See also cooling Page ConstellationES Series SAS Product Manual, Rev. D Page Seagate Technology LLC
Top Page Image Contents