Table of Contents
Advertisement
www.seagate.com
6.2
Advanced Device Security Features
6.2.1
NVMe format
Secure Erase is a standard NVMe format command and it writes all "0xFF" to fully wipe all the data on the SSDs. When
this command is issued, the SSD controller erases its storage blocks and return to its factory default settings.
6.2.2
Physical Presence SID (PSID)
The Physical Presence SID (PSID) is defined by TCG OPAL as a 32-character string and its purpose is to revert the SSD
back to its manufacturing setting when the drive is set via TCG Opal (SED) or TCG Pyrite (non-SED). The PSID code is
printed on the SSD's label. All user data will be erased when reverting the drive back to manufacturing settings.
6.2.3
Manufacturer's Secure ID (MSID)
The Manufacturer's Secure ID (MSID) is defined by TCG OPAL as a 32-character string and is assigned during the
manufacturing process, which is a password that cannot be changed by the host system. MSID can be obtained
electronically from the drive across the interface. On acquiring the SSD, the user must set a new password. If a new
password is not set the SSD might be potentially taken control by anyone who can reset the MSID. Such an attack on
the drive is known as Denial of Service (DoS) since the rightful owner has been locked out.
6.2.4
Sanitize Operation
The Sanitize feature is an alternative to the existing secure erase capabilities through the Format NVM command and
makes a robust data security by ensuring the user data from the drive's media, caches and the Controller Memory
Buffer are all wiped by the block erase operations, overwriting or destroying the encryption key. The following table
illustrates the types of Sanitize Operations supported.
Table 10 Supported Sanitize Operations
Drive Security Type
SED (TCG Opal)
Non-SED (TCG Pyrite)
a.
Crypto Erase is a feature that erases all the data of the AES encrypted data structure by resetting the cryptographic key of the disk. The
previously encrypted data becomes nonrecoverable.
b.
The Instant Security Erase is a feature that erases all the data of the SED drive with the Opal-activated encrypted data structure by resetting
the SSD with the PSID. Since the key is reset, the previously encrypted data cannot be accessed.
c.
IEEE 1667 is supported but needs to be activated by SeaChest_Security tool when required to prevent unintended eDrive implementation
and the following requirement of reverting by PSID before being able to re-install the Operation System.
Seagate BarraCuda 510 SSD Product Manual, Rev A
Sanitize Operation
AES-256
Encryption
Overwrite Block Erase
Yes
Yes
No
Yes
Crypto
PSID Revert
Erase
Process
a
Yes
Yes
Yes
Yes
No
Yes
TCG Commands
Instant Security
Erase
b
Yes
No
IEEE 1667
Windows
eDrive
c
Yes
No
19
Advertisement
Table of Contents
