SED (Self-Encrypting Drives)
Overview
SED (Self-Encrypting Drives)에 대한 기술 문서입니다.
Summary
- 무엇인가? - SED (Self-Encrypting Drives)
- 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
- 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시
Purpose
이 문서가 존재하는 이유
- Goal: SED (Self-Encrypting Drives)에 대한 기술 정보 제공
- Scope: SED (Self-Encrypting Drives)의 개념, 사용법, 설정
- Non-goals: 다른 주제로의 확장
Key Concepts
| Concept | Description | Related |
|---|---|---|
| SED (Self-Encrypting Drives) | HPC/서버 환경에서 중요한 기술 개념 | Linux, Server |
Detailed Explanation
A self-encrypting drive (SED) is a hard disk drive (HDD) or solid-state drive (SSD) designed to automatically encrypt and decrypt drive data without the need for user input or disk encryption software. Samsung, Seagate, and Toshiba, have SEDs on the market today.
Many self-encrypting drives available today implement the OPAL and Enterprise standards developed by the Trusted Computing Group (TCG).
SEDs use an on-board cryptoprocessor to encrypt and decrypt your data.
Unlike with software-based disk encryption, the DEK never makes its way to the host system’s random-access memory (RAM), where it can be accessed by attackers using a cold boot or software-level attack.
msed and OpalTool, the two known Open Source code bases available for self-encrypting drives support on Linux merged to form sedutil
For devices connected via SATA, libata.allow_tpm must be set to 1 (true) in order to use sedutil. Either add libata.allow_tpm=1 to the kernel parameters, or by setting /sys/module/libata/parameters/allow_tpm to 1 on a running system. [1]
- This page shows how to compile and setup sedutil on Ubuntu
- Using Self-Encrypting Drives on Linux page shows high level sedutil-cli usage
# Check hdd support SED using hdparm to check "security" related output
sudo hdparm -I /dev/xxxx
Check if you have OPAL compliant disks using sedutil-cli
# sedutil-cli --scan
Best Practices
- 최신 버전 사용 권장
- 공식 문서 참고
- 테스트 환경에서 먼저 검증
References
Related Pages
Knowledge Graph
Related