SED (Self-Encrypting Drives): Difference between revisions

From HPCWIKI
Jump to navigation Jump to search
(Created page with "A self-encrypting drive (SED) is a hard disk drive (HDD) or solid-state drive (SSD) designed to automatically encrypt and decrypt drive data without the need for user input or disk encryption software. Samsung, Seagate, and Toshiba, have SEDs on the market today. center|frameless|536x536px|SEDs works - Trusted Computing Group Many self-encrypting drives available today implement the OPAL and Enterprise standards developed b...")
 
({{Status}}/{{TOC}} 템플릿 제거)
 
(6 intermediate revisions by 2 users not shown)
Line 1: Line 1:
== Overview ==
SED (Self-Encrypting Drives)에 대한 기술 문서입니다.
=== Summary ===
* 무엇인가? - SED (Self-Encrypting Drives)
* 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
* 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시
== Purpose ==
이 문서가 존재하는 이유
* Goal: SED (Self-Encrypting Drives)에 대한 기술 정보 제공
* Scope: SED (Self-Encrypting Drives)의 개념, 사용법, 설정
* Non-goals: 다른 주제로의 확장
== Key Concepts ==
{| class="wikitable"
! Concept
! Description
! Related
|-
| SED (Self-Encrypting Drives)
| HPC/서버 환경에서 중요한 기술 개념
| [[Linux]], [[Server]]
|}
== Detailed Explanation ==
A self-encrypting drive (SED) is a hard disk drive (HDD) or solid-state drive (SSD) designed to automatically encrypt and decrypt drive data without the need for user input or disk encryption software. Samsung, Seagate, and Toshiba, have SEDs on the market today.
A self-encrypting drive (SED) is a hard disk drive (HDD) or solid-state drive (SSD) designed to automatically encrypt and decrypt drive data without the need for user input or disk encryption software. Samsung, Seagate, and Toshiba, have SEDs on the market today.
[[File:SEDs works-Trusted Computing Group.png|center|frameless|536x536px|SEDs works - Trusted Computing Group]]
[[File:SEDs works-Trusted Computing Group.png|center|frameless|536x536px|SEDs works - Trusted Computing Group]]
Many self-encrypting drives available today implement the OPAL and Enterprise standards developed by the Trusted Computing Group (TCG).  
Many self-encrypting drives available today implement the OPAL and Enterprise standards developed by the Trusted Computing Group (TCG).  
SEDs use an on-board cryptoprocessor to encrypt and decrypt your data.
Unlike with software-based disk encryption, the DEK never makes its way to the host system’s random-access memory (RAM), where it can be accessed by attackers using a cold boot or software-level attack.
''msed'' and ''OpalTool'', the two known Open Source code bases available for self-encrypting drives [[support]] on [[Linux]] merged to form ''[https://github.com/ladar/sedutil sedutil]''
For devices connected via SATA, <code>libata.allow_tpm</code> '''must''' be set to <code>1</code> (true) in order to use sedutil. Either add <code>libata.allow_tpm=1</code> to the [[kernel]] parameters, or by setting <code>/sys/module/libata/parameters/allow_tpm</code> to <code>1</code> on a running system. <ref>https://wiki.archlinux.org/title/Self-encrypting_drives</ref>
* [https://notes.aamnah.com/sysadmin/install_sedutil/ This page] shows how to compile and setup sedutil on Ubuntu
* [https://teejeetech.com/2021/11/28/using-self-encrypting-drives-on-linux/ Using Self-Encrypting Drives on Linux] page shows high level sedutil-cli usage
<syntaxhighlight lang="bash">
# Check hdd support SED using hdparm to check "security" related output
sudo hdparm -I /dev/xxxx
Check if you have OPAL compliant disks using sedutil-cli
# sedutil-cli --scan
</syntaxhighlight>
<references />


SEDs use an on-board cryptoprocessor to encrypt and decrypt your data.
== Best Practices ==
 
* 최신 버전 사용 권장
* 공식 문서 참고
* 테스트 환경에서 먼저 검증
 
== References ==


Unlike with software-based disk encryption, the DEK never makes its way to the host system’s random-access memory (RAM), where it can be accessed by attackers using a cold boot or software-level attack.
* [https://wiki.hpcmate.com SED (Self-Encrypting Drives)]


== SED on Linux ==
== Related Pages ==
''msed'' and ''OpalTool'', the two known Open Source code bases available for self-encrypting drives [[support]] on [[Linux]] merged to form ''[https://github.com/ladar/sedutil sedutil]''


For devices connected via SATA, <code>libata.allow_tpm</code> '''must''' be set to <code>1</code> (true) in order to use sedutil. Either add <code>libata.allow_tpm=1</code> to the kernel parameters, or by setting <code>/sys/module/libata/parameters/allow_tpm</code> to <code>1</code> on a running system. <ref>https://wiki.archlinux.org/title/Self-encrypting_drives</ref>
* [[Linux]]
* [[Server]]
* [[Hardware]]
* [[Network]]


[https://notes.aamnah.com/sysadmin/install_sedutil/ This page] shows how to compile and setup sedutil on Ubuntu and [https://teejeetech.com/2021/11/28/using-self-encrypting-drives-on-linux/ Using Self-Encrypting Drives on Linux] page shows high level sedutil-cli usage
[[Category:Server]]
== Knowledge Graph ==


<syntaxhighlight lang="bash">
Related
Check if you have OPAL compliant disks
# sedutil-cli --scan


</syntaxhighlight>
→ [[Linux]]
→ [[Server]]
→ [[Hardware]]
→ [[Network]]


== References ==
[[Category:Reference]]
<references />

Latest revision as of 13:25, 2 October 2026

Overview

SED (Self-Encrypting Drives)에 대한 기술 문서입니다.

Summary

  • 무엇인가? - SED (Self-Encrypting Drives)
  • 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
  • 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시

Purpose

이 문서가 존재하는 이유

  • Goal: SED (Self-Encrypting Drives)에 대한 기술 정보 제공
  • Scope: SED (Self-Encrypting Drives)의 개념, 사용법, 설정
  • Non-goals: 다른 주제로의 확장

Key Concepts

Concept Description Related
SED (Self-Encrypting Drives) HPC/서버 환경에서 중요한 기술 개념 Linux, Server

Detailed Explanation

A self-encrypting drive (SED) is a hard disk drive (HDD) or solid-state drive (SSD) designed to automatically encrypt and decrypt drive data without the need for user input or disk encryption software. Samsung, Seagate, and Toshiba, have SEDs on the market today.

SEDs works - Trusted Computing Group

Many self-encrypting drives available today implement the OPAL and Enterprise standards developed by the Trusted Computing Group (TCG). SEDs use an on-board cryptoprocessor to encrypt and decrypt your data. Unlike with software-based disk encryption, the DEK never makes its way to the host system’s random-access memory (RAM), where it can be accessed by attackers using a cold boot or software-level attack. msed and OpalTool, the two known Open Source code bases available for self-encrypting drives support on Linux merged to form sedutil For devices connected via SATA, libata.allow_tpm must be set to 1 (true) in order to use sedutil. Either add libata.allow_tpm=1 to the kernel parameters, or by setting /sys/module/libata/parameters/allow_tpm to 1 on a running system. [1] 

# Check hdd support SED using hdparm to check "security" related output
sudo hdparm -I /dev/xxxx 
Check if you have OPAL compliant disks using sedutil-cli
# sedutil-cli --scan
  1. ↑ https://wiki.archlinux.org/title/Self-encrypting_drives

Best Practices

  • 최신 버전 사용 권장
  • 공식 문서 참고
  • 테스트 환경에서 먼저 검증

References

Related Pages

Knowledge Graph

Related

→ Linux → Server → Hardware → Network

Retrieved from "http://wiki.hpcmate.com/index.php?title=SED_(Self-Encrypting_Drives)&oldid=3903"