Highly Secure Encrypted SSD Drive

Drive is an external encrypted hard drive in a rugged metal enclosure, the most advanced in its segment

The highly secure encrypted SSD Drive enables the storage, safekeeping and secure transfer of sensitive business and private data for public authorities and companies in compliance with GDPR regulations.

Drive is approved by the Bureau of Security Information (BSI) for government classified information up to NATO Restricted and EU Restricted. The confidentiality of the data stored on the Drive is protected against unauthorised access, for example in the event of loss or theft of the media, as well as in the event of various types of attack. While the Drive is not connected to a computer or an external power source (e.g. USB or USB hub), it will remain in sleep mode and all keys will be disabled.

Drive guarantees data confidentiality with the following security mechanisms:

• Encryption
• Access control
• Cryptographic Key Management
• User management

Encryption

The encryption module integrated into the security case ensures complete encryption of the Drive. Each stored byte and each written sector on the storage device is encrypted in XTS mode using two cryptographic keys according to 256-bit AES (Advanced Encryption Standard). Drive also encrypts temporary data and areas that are often ignored by conventional encryption software.

User authentication

User authentication is based on the “have and know” principle

• To gain access to the data, the user must have a smart card and know the correct PIN
• If the allowed number of incorrect PIN entries is exceeded, the smart card is deactivated and no longer usable
• Cryptographic keys are also permanently erased

Cryptographic Key Management

The user can generate, change or destroy cryptographic keys at any time. This process is irreversible. Once new cryptographic keys are generated, the old cryptographic keys, and thus all data stored on the data carrier, are irretrievably destroyed. Therefore, all information should be stored on Drive first stored on another encrypted data carrier if necessary. Two 256-bit encryption keys for data encryption and decryption are generated by a hardware random number generator and stored in memory. If the user’s PIN is entered correctly, it is transmitted to the Drive encryption module for data encryption and decryption.