Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a... Bedienungsanleitung

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series

FIPS 140-2 Security Policy

Document Revision: 1.0

H.W. Version: MZILS7T6HMLS-000H9 and MZILS15THMLS-000H9

F.W. Version: 3P00

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 2 of 19

Table of Contents

Introduction..................................................................................................................................... 4

Cryptographic Boundary................................................................................................................. 4

Security Level Specification........................................................................................................... 7

Approved Algorithms ..................................................................................................................... 8

Non-Approved Algorithms ............................................................................................................. 9

Physical Ports and Logical Interfaces............................................................................................. 9

Identification and Authentication Policy...................................................................................... 12

Access Control Policy................................................................................................................... 14

Unauthenticated Services.............................................................................................................. 17

Physical Security Policy ............................................................................................................... 18

Mitigation of Other Attacks Policy............................................................................................... 19

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 3 of 19

Revision History

Author(s)

Version

Updates

SeungJae Lee

1.0

Initial Version

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 4 of 19

Introduction

Samsung Electronics Co., Ltd. (“Samsung”) SAS 12G TCG Enterprise SSC SEDs

PM1633a Series, herein after referred to as a “cryptographic module” or “module”,

SSD (Solid State Drive), satisfies all applicable FIPS 140-2 Security Level 2

requirements, supporting TCG Enterprise SSC based SED (Self-Encrypting Drive)

features, designed to protect unauthorized access to the user data stored in its

NAND Flash memories. The built-in AES HW engines in the cryptographic

module’s controller provide on-the-fly encryption and decryption of the user data

without performance loss. The SED’s nature also provides instantaneous

sanitization of the user data via cryptographic erase.

Module Name

Hardware Version

Firmware

Version

Drive

Capacity

Samsung SAS 12G TCG Enterprise

SSC SED PM1633a

MZILS7T6HMLS-000H9

3P00

7.6TB

MZILS15THMLS-000H9

3P00

15.2TB

Exhibit 1 –Versions of Samsung SAS 12G TCG Enterprise SSC SED PM1633a

Series.

Cryptographic Boundary

The following photographs show the cryptographic module’s top and bottom views.

The multiple-chip standalone cryptographic module consists of hardware and

firmware components that are all enclosed in two aluminum alloy cases, which

serve as the cryptographic boundary of the module. The top and bottom cases are

assembled by screws and the tamper-evident labels are applied for the detection of

any opening of the cases. No security relevant component can be seen within the

visible spectrum through the opaque enclosure.

New firmware versions within the scope of this validation must be validated

through the FIPS 140-2 CMVP. Any other firmware loaded into this module is out

of the scope of this validation and requires a separate FIPS 140-2 validation.

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 5 of 19

Exhibit 2 –Specification of the Samsung SAS 12G TCG Enterprise SSC SEDs

PM1633a Series Cryptographic Boundary (From top to bottom –Left to right:

top side, bottom side, front side, back side, left side, and right side).

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 6 of 19

Exhibit 3 –Block Diagram for Samsung SAS 12G TCG Enterprise SSC

SEDs PM1633a Series.

Acronym

Description

CTRL

REX Controller (SAMSUNG TREX SAS 12G

TLC/MLC SSD Controller)

Sub-CTRL

Falconet Controller (SAMSUNG Sub-Controller)

SAS I/F

Serial Attached SCSI Interface

CPU

Central Processing Unit (ARM-based)

DRAM I/F

Dynamic Random Access Memory Interface

ECC

Error Correcting Code

NAND I/F

NAND Flash Interface

PMIC

Power Management Integrated Circuit

ROM

Read-only Memory

DRAM

Dynamic Random Access Memory

NAND

NAND Flash Memory

LBA

Logical Block Address

MEK

Media Encryption Key

MSID

Manufactured SID(Security Identifier)

Exhibit 4 –Acronym and Descriptions for Samsung SAS 12G TCG

Enterprise SSC SEDs PM1633a Series.

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 7 of 19

Security Level Specification

Security Requirements Area

Level

Cryptographic Module Specification

Cryptographic Module Ports and Interfaces

Roles, Services, and Authentication

Finite State Model

Physical Security

Operational Environment

N/A

Cryptographic Key Management

EMI/EMC

Self-tests

Design Assurance

Mitigation of Other Attacks

N/A

Exhibit 5 –Security Level Table.

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 8 of 19

Approved Algorithms

The cryptographic module supports the following Approved algorithms for secure

data storage:

CAVP

Cert.

Algorithm

Standard

Mode /

Method

Key Lengths,

Curves or Moduli

Use

617

AES

FIPS 197

SP 800-38A

ECB

256-bit

Data Encryption /

Decryption

Note: AES-ECB is

only utilized as the

pre-requisite for

DRBG #121; no

other modes or key

sizes are used and it

is not otherwise

exposed in this

implementation

whatsoever.

3213

AES

FIPS 197

SP 800-38E

XTS

256-bit

Data Encryption /

Decryption

Note: AES-ECB is

the pre-requisite for

AES-XTS; AES-ECB

alone is NOT

supported by the

cryptographic

module in FIPS

Mode.

121

DRBG

SP 800-90A

Revision 1

CTR_ DRBG

AES-256

Deterministic

Random Bit

Generation

932

ECDSA

FIPS 186-4

SigVer

P-224

Digital Signature

Verification

3382

SHS

FIPS 180-4

SHA-256

Message Digest

Exhibit 6 -Samsung SAS 12G TCG Enterprise SSC SED PM1633a Series

Approved Algorithms.

NOTE 1: The cryptographic module implements LSI Corporation’s LSI-CS

DRBG in its original entirety without alteration. (I.e. there have been no

changes to the cryptographic algorithm boundary whatsoever). Testing was

carried out by LSI in a Synopsys VCS simulation environment; additional

algorithm validation testing in not required as per FIPS 140-2 IG G.11

NOTE 2: This module supports AES-XTS which is only approved for

storage applications.

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 9 of 19

NOTE 3: The additional 128 and 192 bit AES in the DRBG #121 is latent

functionality and is not utilized in the Samsung PM1633a cryptographic

module whatsoever.

Non-Approved Algorithms

The cryptographic module supports the following non-Approved but allowed

algorithms:

Algorithm

Caveat

Use

NDRNG

Non-deterministic Random Number Generator (only

used for generating seed materials for the Approved

DRBG)

Exhibit 7 -Samsung SAS 12G TCG Enterprise SSC SED PM1633a Series non-

Approved but allowed algorithms.

Physical Ports and Logical Interfaces

Physical Port

Logical Interface

SAS Connector

Data Input/Output

Control Input

Status Output

Power Connector

Power Input

Exhibit 8 –Specification of the Samsung SAS 12G TCG Enterprise SSC SED

PM1633a Series Cryptographic Module Physical Ports and Logical Interfaces.

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy

Page 10 of 19

Security rules

The following specifies the security rules under which the cryptographic module

shall operate in accordance with FIPS 140-2:

The cryptographic module operates always in FIPS Mode once shipped from

the vendor's manufacturing site.

The steps necessary for the secure installation, initialization and start-up of

the cryptographic module as per FIPS 140-2 VE10.03.01 are as follows:

oStep1. User should examine the tamper evidence

Inspect the entire perimeter for cracks, gouges, lack of screw(s)

and other signs of tampering including the tamper evident

sealing label.

If there is any sign of tampering, do not use the product and

contact Samsung.

oStep2. Identify the firmware version in the device

Confirm that the firmware version is equivalent to the version(s)

listed in this document via SCSI Inquiry command

oStep3. Take the drive’s ownership

Change SID’s PIN by setting a new PIN

Change EraseMaster’s PIN by setting a new PIN

Erase Method on each LBA Range to rekey the encryption key

Change BandMaster0~7’s PIN by setting new PINs

Configure the LBA Range(s) by setting ReadLockEnabled and

WriteLockEnabled columns to True

Don’t change LockOnReset column in Locking Table so that

the drive always gets locked after a power cycle

oStep4. Configure FW download and Diagnostic features

Disable Makers Class using SID Authority to disable FW

download and Diagnostic features

Enable Makers Class only when FW download and Diagnostic

features are needed

oStep5. Periodically examine the tamper evidence

If there is any sign of tampering, stop using the product to avoid

a potential security hazard or information leakage.

The cryptographic module shall maintain logical separation of data input,

data output, control input, status output, and power.

The cryptographic module shall not output CSPs in any form.

The cryptographic module shall use the Approved DRBG for generating all

cryptographic keys.

Inhaltsverzeichnis

Andere Samsung Computerhardware Handbücher

Samsung

Samsung S3C2500B Bedienungsanleitung

Samsung

Samsung CY-WDCB7UT Bedienungsanleitung

Samsung

Samsung SVMi-4 Bedienungsanleitung

Samsung

Samsung SM-V201 Bedienungsanleitung

Samsung

Samsung S3C80A5B Bedienungsanleitung

Samsung

Samsung AllShare Cast Dongle Bedienungsanleitung

Samsung

Samsung MTP02P Series Bedienungsanleitung

Samsung

Samsung MT6402-48A Bedienungsanleitung

Samsung

Samsung MT3204 Series Bedienungsanleitung

Samsung

Samsung S3C2410 Bedienungsanleitung

Samsung

Samsung VG-STDB10 Bedienungsanleitung

Samsung

Samsung SGH-Z800 Bedienungsanleitung

Samsung

Samsung M391B5273DH0 Gebrauchsanweisung

Samsung

Samsung SMDK-C100 Bedienungsanleitung

Samsung

Samsung S5PC100 Bedienungsanleitung

Samsung

Samsung M471B1G73AH0 Gebrauchsanweisung

Samsung

Samsung S3C2451X Bedienungsanleitung

Samsung

Samsung HW-Q630A Montageanleitung

Samsung

Samsung iDCS 500 Bedienungsanleitung

Samsung

Samsung S5PC110 Bedienungsanleitung

Samsung

Samsung HW-Q600A Montageanleitung

Samsung

Samsung S3F84A5 Montage- und Bedienungsanleitung

Samsung

Samsung S3C2450 Bedienungsanleitung

Samsung

Samsung WNI20NC0301 Bedienungsanleitung

Beliebte Computerhardware Handbücher anderer Marken

EMC2

EMC2 VNX Series Betriebsanleitung

Panasonic

Panasonic DV0PM20105 Bedienungsanleitung

Mitsubishi Electric

Mitsubishi Electric Q81BD-J61BT11 Bedienungsanleitung

Gigabyte

Gigabyte B660M DS3H AX DDR4 Bedienungsanleitung

Raidon

Raidon iT2300 Bedienungsanleitung

National Instruments

National Instruments PXI-8186 Bedienungsanleitung

Hauppauge

Hauppauge WinTV-HVR-2250 Bedienungsanleitung

Kontron

Kontron CP6002 Bedienungsanleitung

Manhattan

Manhattan 702843 Bedienungsanleitung

Aphex

Aphex 230 Bedienungsanleitung

Intel

Intel NUC 12 Pro Bedienungsanleitung

Galaxy

Galaxy GHDX2-2430S-24F4D Bedienungsanleitung

Intel

Intel AXXRMFBU4 Bedienungsanleitung

Kontron

Kontron DIMM-PC/MD Bedienungsanleitung

ST X-NUCLEO-SAFEA1B Betriebsanleitung

STEINWAY LYNGDORF

STEINWAY LYNGDORF SP-1 Bedienungsanleitung

Advantech

Advantech ASMB-935 Series Bedienungsanleitung

Jupiter

Jupiter RAM PACK Bedienungsanleitung