SED (Self-Encrypting Drives): Difference between revisions

From HPCWIKI
Jump to navigation Jump to search
(Fix: remove --- horizontal lines (7 removed))
 
(3 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{Status
|status=Draft
|owner=Knowledge Agent
|last_update=2026-07-16
|review=Pending
}}
{{TOC}}
== Overview ==
SED (Self-Encrypting Drives)에 대한 기술 문서입니다.
=== Summary ===
* 무엇인가? - SED (Self-Encrypting Drives)
* 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
* 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시
== Purpose ==
이 문서가 존재하는 이유
* Goal: SED (Self-Encrypting Drives)에 대한 기술 정보 제공
* Scope: SED (Self-Encrypting Drives)의 개념, 사용법, 설정
* Non-goals: 다른 주제로의 확장
== Key Concepts ==
{| class="wikitable"
! Concept
! Description
! Related
|-
| SED (Self-Encrypting Drives)
| HPC/서버 환경에서 중요한 기술 개념
| [[Linux]], [[Server]]
|}
== Detailed Explanation ==
A self-encrypting drive (SED) is a hard disk drive (HDD) or solid-state drive (SSD) designed to automatically encrypt and decrypt drive data without the need for user input or disk encryption software. Samsung, Seagate, and Toshiba, have SEDs on the market today.
A self-encrypting drive (SED) is a hard disk drive (HDD) or solid-state drive (SSD) designed to automatically encrypt and decrypt drive data without the need for user input or disk encryption software. Samsung, Seagate, and Toshiba, have SEDs on the market today.
[[File:SEDs works-Trusted Computing Group.png|center|frameless|536x536px|SEDs works - Trusted Computing Group]]
[[File:SEDs works-Trusted Computing Group.png|center|frameless|536x536px|SEDs works - Trusted Computing Group]]
Many self-encrypting drives available today implement the OPAL and Enterprise standards developed by the Trusted Computing Group (TCG).  
Many self-encrypting drives available today implement the OPAL and Enterprise standards developed by the Trusted Computing Group (TCG).  
SEDs use an on-board cryptoprocessor to encrypt and decrypt your data.
SEDs use an on-board cryptoprocessor to encrypt and decrypt your data.
Unlike with software-based disk encryption, the DEK never makes its way to the host system’s random-access memory (RAM), where it can be accessed by attackers using a cold boot or software-level attack.
Unlike with software-based disk encryption, the DEK never makes its way to the host system’s random-access memory (RAM), where it can be accessed by attackers using a cold boot or software-level attack.
== SED on Linux ==
''msed'' and ''OpalTool'', the two known Open Source code bases available for self-encrypting drives [[support]] on [[Linux]] merged to form ''[https://github.com/ladar/sedutil sedutil]''
''msed'' and ''OpalTool'', the two known Open Source code bases available for self-encrypting drives [[support]] on [[Linux]] merged to form ''[https://github.com/ladar/sedutil sedutil]''
 
For devices connected via SATA, <code>libata.allow_tpm</code> '''must''' be set to <code>1</code> (true) in order to use sedutil. Either add <code>libata.allow_tpm=1</code> to the [[kernel]] parameters, or by setting <code>/sys/module/libata/parameters/allow_tpm</code> to <code>1</code> on a running system. <ref>https://wiki.archlinux.org/title/Self-encrypting_drives</ref>
For devices connected via SATA, <code>libata.allow_tpm</code> '''must''' be set to <code>1</code> (true) in order to use sedutil. Either add <code>libata.allow_tpm=1</code> to the kernel parameters, or by setting <code>/sys/module/libata/parameters/allow_tpm</code> to <code>1</code> on a running system. <ref>https://wiki.archlinux.org/title/Self-encrypting_drives</ref>
 
* [https://notes.aamnah.com/sysadmin/install_sedutil/ This page] shows how to compile and setup sedutil on Ubuntu  
* [https://notes.aamnah.com/sysadmin/install_sedutil/ This page] shows how to compile and setup sedutil on Ubuntu  
* [https://teejeetech.com/2021/11/28/using-self-encrypting-drives-on-linux/ Using Self-Encrypting Drives on Linux] page shows high level sedutil-cli usage
* [https://teejeetech.com/2021/11/28/using-self-encrypting-drives-on-linux/ Using Self-Encrypting Drives on Linux] page shows high level sedutil-cli usage
<syntaxhighlight lang="bash">
<syntaxhighlight lang="bash">
# Check hdd support SED using hdparm to check "security" related output
# Check hdd support SED using hdparm to check "security" related output
sudo hdparm -I /dev/xxxx  
sudo hdparm -I /dev/xxxx  
Check if you have OPAL compliant disks using sedutil-cli
Check if you have OPAL compliant disks using sedutil-cli
# sedutil-cli --scan
# sedutil-cli --scan
</syntaxhighlight>
<references />
== Best Practices ==
* 최신 버전 사용 권장
* 공식 문서 참고
* 테스트 환경에서 먼저 검증


</syntaxhighlight>


== References ==
== References ==
<references />


[[Category: storage]]
* [https://wiki.hpcmate.com SED (Self-Encrypting Drives)]
 
 
== Related Pages ==
 
* [[Linux]]
* [[Server]]
* [[Hardware]]
* [[Network]]
 
 
[[Category:Server]]
== Knowledge Graph ==
 
Related
 
→ [[Linux]]
→ [[Server]]
→ [[Hardware]]
→ [[Network]]
 
[[Category:Reference]]

Latest revision as of 11:30, 17 July 2026

Template:Status

Template:TOC

Overview

SED (Self-Encrypting Drives)에 대한 기술 문서입니다.

Summary

  • 무엇인가? - SED (Self-Encrypting Drives)
  • 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
  • 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시


Purpose

이 문서가 존재하는 이유

  • Goal: SED (Self-Encrypting Drives)에 대한 기술 정보 제공
  • Scope: SED (Self-Encrypting Drives)의 개념, 사용법, 설정
  • Non-goals: 다른 주제로의 확장


Key Concepts

Concept Description Related
SED (Self-Encrypting Drives) HPC/서버 환경에서 중요한 기술 개념 Linux, Server


Detailed Explanation

A self-encrypting drive (SED) is a hard disk drive (HDD) or solid-state drive (SSD) designed to automatically encrypt and decrypt drive data without the need for user input or disk encryption software. Samsung, Seagate, and Toshiba, have SEDs on the market today.

SEDs works - Trusted Computing Group

Many self-encrypting drives available today implement the OPAL and Enterprise standards developed by the Trusted Computing Group (TCG). SEDs use an on-board cryptoprocessor to encrypt and decrypt your data. Unlike with software-based disk encryption, the DEK never makes its way to the host system’s random-access memory (RAM), where it can be accessed by attackers using a cold boot or software-level attack. msed and OpalTool, the two known Open Source code bases available for self-encrypting drives support on Linux merged to form sedutil For devices connected via SATA, libata.allow_tpm must be set to 1 (true) in order to use sedutil. Either add libata.allow_tpm=1 to the kernel parameters, or by setting /sys/module/libata/parameters/allow_tpm to 1 on a running system. [1] 

# Check hdd support SED using hdparm to check "security" related output
sudo hdparm -I /dev/xxxx 
Check if you have OPAL compliant disks using sedutil-cli
# sedutil-cli --scan
  1. ↑ https://wiki.archlinux.org/title/Self-encrypting_drives


Best Practices

  • 최신 버전 사용 권장
  • 공식 문서 참고
  • 테스트 환경에서 먼저 검증


References


Related Pages

Knowledge Graph

Related

→ Linux → Server → Hardware → Network

Retrieved from "http://wiki.hpcmate.com/index.php?title=SED_(Self-Encrypting_Drives)&oldid=3436"