Seagate bakes security into hard drive

The Scotts Valley, Calif.-based company has developed full-disk encryption technology that can be built into hard-disk drives. The new Seagate DriveTrust Technology automatically encrypts all the data written to the disk, making it inaccessible to anyone who doesn't have the correct password when the computer first boots up.

"It is a new way of thinking about what the capabilities are of the hard drive, beyond just storage," said Scott Shimomura, senior product marketing manager at Seagate.

Data breach and privacy legislation has made security a hot topic, in particular for portable PCs and storage devices. In the past year, major organizations, including the U.S. Department of Veterans Affairs and Fidelity Investments, have had to report embarrassing security breaches after hardware containing personal data on people went missing.

"The primary market right now is the mobile computing market, because there is so much sensitive data that is being stored on notebooks," Shimomura said. "But we view DriveTrust as something that can be used in all drives."

DriveTrust is already available in Seagate's DB35 disk drives for digital video recorders and other digital entertainment devices. In the first quarter of next year, the company plans to ship a hard-disk drive for notebooks that features the technology, called the Momentus 5400 FDE 2.

Seagate pitches its encrypting hard disk as an alternative to full-disk encryption software such as products sold by PGP and PointSec Mobile Technologies. Additionally, high-end editions of Microsoft's upcoming Windows Vista operating system include an encryption feature called BitLocker.

"All of the data is being encrypted and decrypted on the fly," Shimomura said about DriveTrust. "There is no processor and memory consumption, because the encryption is all happening down in the drive. Tests we have done internally have shown minimal impact on throughput and write-read performance."

Disk drives with the new technology contain an encryption chip and special software that runs it. The encryption on the Momentus drive will use a 128-bit Advanced Encryption Standard, or AES, algorithm. It will be available in capacities up to 160 GB.

Seagate, the world's biggest hard-drive maker, expects the new Momentus drive to ship in notebook computers starting next year. Users will be asked to set up a password as soon as they start their new PC for the first time. This password will then be required each time the computer is booted up.

Enterprises and other organizations will be able to manage passwords and encryption keys by using third-party software, Shimomura said. Wave Systems and Secude are working on providing such tools, he said. If a password is lost, the drive could be reset by Seagate, but there would be no way to get to the data.

But the boot-up password could also prove to be a weakness in the DriveTrust protection. The encryption is unlocked as long as a computer isn't completely switched off. That could mean trouble with Windows Vista, which by default goes into "hibernation" mode, instead of shutting down.

"If the computer is on and the drive has been authenticated to, the data is available and so it is vulnerable," Shimomura acknowledged. Users will have to completely shut down their Vista computers for the Seagate technology to be effective.

Seagate isn't the only disk drive maker working on encrypting hard-disk drives. The company leads an effort in the Trusted Computing Group that plans to provide a formal secure storage specification early next year. Other storage companies, including competing hard-drive makers, also participate in the effort.

"By no means do we want Seagate to be the only company to do this," Shimomura said. "More people will enter the market, and it will be an open specification."

Drives with the technology will cost more than regular drives, but Seagate declined to specify the price premium. However, a Fujitsu notebook that will use the technology is priced $125 over a regular model, Seagate said. That price premium, the company noted, is not wholly attributable to the new disk drive.