computer science

Hardware-based full disk encryption

Hardware-based full disk encryption is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Hardware-based full disk encryption rather than just read about it. In short: Hardware-based full disk encryption (FDE) is available from many hard disk drive (HDD/SSD) vendors, including Kingston Technology, Integral Memory, iStorage Limited, Micron, Seagate Technology, Sandisk, Samsung, Toshiba, Viasat UK, and Western Digital. The symmetric encryption key is maintained independently from the computer's CPU, thus allowing the complete data store to be encrypted and removing computer memory a…

Key takeaways

Hardware-based full disk encryption belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Hardware-based full disk encryption to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Hardware-based full disk encryption from memory before moving on to harder problems.

Reference excerpt

Hardware-based full disk encryption (FDE) is available from many hard disk drive (HDD/SSD) vendors, including Kingston Technology, Integral Memory, iStorage Limited, Micron, Seagate Technology, Sandisk, Samsung, Toshiba, Viasat UK, and Western Digital. The symmetric encryption key is maintained independently from the computer's CPU, thus allowing the complete data store to be encrypted and removing computer memory as a potential attack vector. Hardware-FDE has two major components: the hardware encryptor and the data store. There are currently multiple varieties of hardware-FDE in common use:

Hard disk drive (HDD) or solid-state drive (SSD) FDE (self-encrypting drive) Enclosed hard disk drive FDE Removable hard disk drive FDE Bridge and Chipset (BC) FDE Hardware designed for a particular purpose can often achieve better performance than disk encryption software, and disk encryption hardware can be made more transparent to software than encryption done in software. As soon as the key has been initialised, the hardware should in principle be completely transparent to the OS and thus work with any OS. If the disk encryption hardware is integrated with the media itself the media may be designed for better integration. One example of such design would be through the use of physical sectors slightly larger than the logical sectors.

Hardware-based full disk encryption types

Hard disk drive or solid-state drive FDE Usually referred to as self-encrypting drive (SED). HDD or SSD FDE is made by HDD or SSD vendors using the OPAL and Enterprise standards developed by the Trusted Computing Group. Key management takes place within the hard disk controller and encryption keys are 128 or 256 bit Advanced Encryption Standard (AES) keys. Authentication on power up of the drive must still take place within the CPU via either a software pre-boot authentication environment (i.e., with a software-based full disk encryption component - hybrid full disk encryption) or with a BIOS password. In additions, some SEDs support IEEE 1667 standard. Hitachi, Micron, Seagate, Samsung, and Toshiba are the disk drive manufacturers offering Trusted Computing Group Opal Storage Specification Serial ATA drives. HDDs have become a commodity so SED allow drive manufacturers to maintain revenue. Older technologies include the proprietary Seagate DriveTrust, and the older, and less secure, PATA Security command standard shipped by all drive makers including Western Digital. Enterprise SAS versions of the TCG standard are called "TCG Enterprise" drives.

Enclosed hard disk drive FDE Within a standard hard drive form factor case the encryptor (BC), key store and a smaller form factor, commercially available, hard disk drive is enclosed.

The enclosed hard disk drive's case can be tamper-evident, so when inspected the user can be assured that the data has not been compromised. The encryptors electronics including the key store and integral hard drive (if it is solid-state) can be protected by other tamper respondent measures. The key can be purged, allowing a user to prevent their authentication parameters being used without destroying the encrypted data. Later the same key can be re-loaded into the Enclosed hard disk drive FDE, to retrieve this data. Tampering is not an issue for SEDs as they cannot be read without the decryption key, regardless of access to the internal electronics . Examples include Viasat UK (formerly Stonewood Electronics) with their FlagStone, Eclypt and DARC-ssd drives or GuardDisk with an RFID token.

Removable hard drive FDE The inserted hard drive FDE allows a standard form factor hard disk drive to be inserted into it. The concept can be seen on

This is an improvement on removing [unencrypted] hard drives from a computer and storing them in a safe when not in use. This design can be used to encrypt multiple drives using the same key. Generally they are not securely locked so the drive's interface is open to attack.

Chipset FDE The encryptor bridge and chipset (BC) is placed between the computer and the standard hard disk drive, encrypting every sector written to it. Intel announced the release of the Danbury chipset but has since abandoned this approach.

Characteristics Hardware-based encryption when built into the drive or within the drive enclosure is notably transparent to the user. The drive, except for bootup authentication, operates just like any drive, with no degradation in performance. There is no complication or performance overhead, unlike disk encryption software, since all the encryption is invisible to the operating system and the host computer's processor. The two main use cases are Data at rest protection, and Cryptographic Disk Erasure. For Data at rest protection a computer or laptop is simply powered off. The disk now self-protects all the data on it. The data is safe because all of it, even the OS, is now encrypted, with a secure mode of AES, and locked from reading and writing. The drive requires an authentication code which can be as strong as 32 bytes (256 bits) to unlock.

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Hardware-based full disk encryption

Start with the simplest possible case. Write down what Hardware-based full disk encryption claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Hardware-based full disk encryption before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Hardware-based full disk encryption ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Hardware-based full disk encryption

In research: Hardware-based full disk encryption appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Hardware-based full disk encryption in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Hardware-based full disk encryption is common in secondary-school and first-year university syllabi. It links to neighbouring topics Cryptographic hardware, Disk encryption, so understanding it makes those chapters shorter.
In everyday life: Look for Hardware-based full disk encryption outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Hardware-based full disk encryption in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Hardware-based full disk encryption means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Hardware-based full disk encryption out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Hardware-based full disk encryption in simple terms?

Why does Hardware-based full disk encryption matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Hardware-based full disk encryption?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Hardware-based full disk encryption.