Mercury Systems ASURRE-Stor ADR256 Administrative Guidance Download Page 23 | Manualshive

Page: 23 / 23

Mercury Systems ASURRE-Stor ADR256 Administrative Guidance Download Page 23

Mercury Systems

ASURRE

-Stor

®

SSD

Administrative Guidance

Copyright 2020 Mercury Systems. May only be reproduced in its original form (without revision)

Rev. 1.5.1 February 2020 © 2020 Mercury Systems. All rights reserved

Mercury Systems, Inc. • (602) 437-1520 •

23

30

Change log

Revision

By

Description

Rev. 1.5.0.00

Bob Laz.

11/21/2016
Numerous changes to support operation with an AA profile. Changes are highlighted in yellow.

06/26/2017
Very minor change, fixed spelling error in Section 3. (TEO should have been TOE).
Changed document data on cover pager to 6/26/2017
Changed footer to reflect new date 6/26/2017

8/16/2017
Added references to the

SSD Secure Configuration Programmer’s Guide in section 16 and in the reference

documents list, Table 2. Changed dates in Footer to August 2017 and cover sheet to August 16, 2017.

8/23/17
Modified per Evaluation findings.

Rev. 1.5.1

Bob Laz.
Sabrina Piña

8/21/2019
Updates for re-certification. Document Dates, footers, and cPP versions updated.

11/25/2019
Updated Mercury logo, document dates, TOC, header, and footer.
Updated sections 7, 18, and 29 to describe the management of power-saving states.
Improved section 29 to better identify the secure configuration steps as requirements by bolding the shall text.
Added section 20 to describe how to change the User or Master ATA password after initial TOE configuration.

12/30/2019
Updated section 25 to describe changing firmware using a file provided by Mercury Systems and the ATA
DOWNLOAD MICROCODE command.

2/4/2020
Updated document dates and copyright on cover page and footer.
Updated section 29 to warn Crypto Officers about BIOS

manufacturer’s that capture and store ATA password

information for lost password recovery.
Improved the description of Mode 6 set up on page 7 to add clarity on how the BEV(KEK) is created and used.

«
...
21
22
23

Summary of Contents for ASURRE-Stor ADR256

Page 1: ...20 Mercury Systems All rights reserved Mercury Systems ASURRE Stor SSD Administrative Guidance Mercury Systems ASURRE Stor ASD256 512 and ADR256 512 Solid State Self Encrypting Drives Non Proprietary...

Page 2: ...oduct Identification 8 11 Evaluated Configuration 9 12 Part numbers 10 13 Scope of evaluation 11 14 Operating Environment 11 15 Operating environment assumptions and requirements 12 16 Unattended oper...

Page 3: ...y 17 Table 7 LED Indicator Port 17 Table 8 Password strength in bits 21 List of Figures Figure 1 View of the holographic label located in the center of the main label 9 Figure 2 Images of the ASURRE S...

Page 4: ...ration of the TOE Please note that use of the MDU utility is optional and not part of the evaluation Programmer s Guide or SSD Programmer s Guide ssdProgrammersGuide pdf This document provides detaile...

Page 5: ...Maximum which determine how the TOE behaves when the Master Password issued to unlock the device Refer to the ATA7 specification V1 page 22 MDU MDU Utility Mercury Systems Drive Utility MDU is a Windo...

Page 6: ...r unencrypted shadow MBR sectors or 3rd party Opal software The ASURRE Stor SSD was evaluated against the Common Criteria Collaborative Protection Profile for Full Drive Encryption Encryption Engine v...

Page 7: ...erformed on the TOE The CO configures the TOE using MDU or a similar custom utility program to operate in Mode 6 The CO fills the BEV KEK and enters a password of up to 64 characters The TOE condition...

Page 8: ...ower is removed from the TOE the TOE enters power state D3 cold a fully powered off condition Only power state D0 allows access to plain text data Since SSDs never receive warning of imminent power lo...

Page 9: ...ommand described in SSD Secure Configuration Programmer s Guide section 2 2 to verify that the TOE reports Firmware revision number 1 5 1 Alternatively the MDU utility can be used Refer to MDU section...

Page 10: ...0 Standard product 1 Electrically isolate enclosure 2 Erase pin 1 option Trigger an erase sanitize operation from SATA pin P1 Option Field z 0 Standard product 1 Legacy erase option Same as field y O...

Page 11: ...and is conditioned by PBKDF SP 800 132 to create an intermediate derived key that is used to AES key wrap AES KW 256 SP 800 38F the DEK The wrapped DEK is saved in NVRAM During normal operation On ea...

Page 12: ...fill cables and any needed voltage translation The Administrator and or system designers shall implement application techniques safeguards and or procedures to assure that power is removed from the TO...

Page 13: ...g mode prior to deployment 18 Secure Configuration Prior to configuration the Administrator must determine the appropriate key management mode for operation Selecting the mode impacts how the host sys...

Page 14: ...lication c Require the ATA user password enables the KEK with BLACK key and ATA Password mode Set the ATA Password Length to 64 bytes d Enable the Secure Erase Trigger option e Select a Default Secure...

Page 15: ...nce are listed below a KEK and BLACK DEK mode must be set to KEK and BLACK DEK b The Key Source selection is determined by the CO as required by the fielded application c Require the ATA user password...

Page 16: ...the ATA password and issue the Get Drive Information command and verify that the TOE is in a CC compliant mode 21 Changing the User or Master ATA Password after the TOE is configured The TOE supports...

Page 17: ...t 23 Installing the TOE into a host system ESD The ASURRE Stor SSD utilizes both active and passive techniques to mitigate damage caused by severe electro static discharge Mercury Systems recommends f...

Page 18: ...SSD SATA Connector Warning The power segments of most commercial SATA connectors have every three pins shorted Refer to images in Figure 7 P1 P2 and P3 3 3V shorted P4 P5 and P6 GND shorted P7 P8 and...

Page 19: ...oves the encrypted result to the NAND media The User Role after successful authentication can access previously encrypted data stored in the NAND media Prior to authentication the User Role cannot wri...

Page 20: ...components in the TOE use production grade materials The printed circuit board is conformal coated and all BGA devices are under filled with a hard opaque epoxy to prevent easy probing of individual...

Page 21: ...ion prevents an attacker from attempting to change to a different firmware version in the field The Crypto Officer shall enforce the use of 8 character minimum password lengths for the User ATA Passwo...

Page 22: ...bel for signs of removal at least once per year While not intended as a tamper seal the label can be difficult to remove and can show signs of damage such as tearing discoloration or other damage if i...

Page 23: ...ugust 16 2017 8 23 17 Modified per Evaluation findings Rev 1 5 1 Bob Laz Sabrina Pi a 8 21 2019 Updates for re certification Document Dates footers and cPP versions updated 11 25 2019 Updated Mercury...

Reviews:

No comments