Mercury Systems
ASURRE
-Stor
®
SSD
Administrative Guidance
Copyright 2020 Mercury Systems. May only be reproduced in its original form (without revision)
Rev. 1.5.1 February 2020 © 2020 Mercury Systems. All rights reserved
Mercury Systems, Inc. • (602) 437-1520 •
14
Direct Configuration
The initial secure configuration of the TOE can be accomplished using standard SATA commands and referencing
reg
ister level descriptions defined in the SSD Programmer’s Guide and the SSD Secure Configuration Programmer’s
Guide.
During the secure configuration procedure, specific configuration parameters are configured to CC compliant values.
The TOE parameters that do not affect CC compliance are allowed but were not evaluated. Examples of parameters
required for CC compliance are listed below.
a.
“KEK and BLACK DEK” mode must be set to “KEK and BLACK DEK”.
b.
The “Key Source” selection is determined by the CO as requi
red by the fielded application.
c.
“Require the ATA user password…” (enables the KEK with BLACK key and ATA Password mode). Set the “ATA Password Length” to 64
bytes.
d.
Enable the “Secure Erase Trigger” option.
e.
Select a “Default Secure Erase Operation”. All e
rase operations erase the key and are CC compliant.
f.
Enable the “Authentication Penalty” by selecting a value of 1, 5, 10
, or 15.
g.
To prevent the user from changing the firmware after configuration completes, select “Disable” for the “Firmware Updates” opt
ion.
h.
Disable the “Password Recovery” feature.
i.
Verify that the “MSD Settings Log” is set to a value of “Version 3”.
j.
Disable the
“Intermediate Power Save Mode” option.
k.
Define the Configuration Password.
l.
Issue
the “Execute Security Command” and define a Use
r ATA password.
m.
Define and install the BEV(KEK) and BLACK key values.
n.
Cycle TOE power, and then verify the TOE is in a (CSfC) CC compliant mode.
The detailed commands to perform these steps are found (in sequential order, with all implementation details
r
eferenced) in section 2 of the SSD Secure Configuration Programmer’s Guide.
Figure 4: Diagram of operation in Mode 6, ATA Password with KEK and BLACK key
