NVMe HDD Security “Out-of-Band” Attestation Introduced at OCP

Late last year, Seagate demonstrated the first hard drive with native NVMe support at the 2021 OCP Summit. The demo version of the HDD sported a tri-band controller that supported SATA, SAS, and NVMe protocols through a native NVMe interface without requiring a bridge. Read NVMe HDD Edges Closer to Reality for background.

During this year’s OCP Global Summit, Seagate provided an update on the progress made to deliver NVMe HDDs, and it looks like they are getting close as engineering samples have started shipping.

NVMe HDD Updates

There has been a lot of movement around NVMe 2.0 since the specifications were released in April, with an updated specification, NVMe 2.0c, published in October. Something to highlight is the NVMe 2.0 specifications were “restructured to enable faster and simpler development of NVMe solutions and to support the increasingly diverse NVMe device environment.” Now, NVMe 2.0 ratifies support for spinning disks.

Adding support for NVMe provides a layer of security that had been unavailable in the past. In a standard SATA or SAS environment, especially with JBODs, it was possible to insert a drive or chassis into the data path, and the system would start scanning the new devices. Once the scan is complete, SAS verifies the volume, or RAID group, exists, providing the path for the disks to be injected through the discovery process.

With the new NVMe HDD proposal, the PCIe layer is split into trusted and untrusted devices, with the verifier separate from the system. Until the verifier trusts the devices, they will be ignored by the host. This is a significant security improvement.

The takeaway from the NVMe HDD presentation at OCP Global Summit was to focus on the goal of consolidating on NVMe as the primary storage interface, without the need for a bridge or any third-party hardware, and making NVMe the standard transport layer for storage I/O across all types of media. Two recommendations in the specification include maintaining the 3.5″ form factor and preserving SATA/SAS connectors and pinouts, simplifying integrating NVMe HDDs into existing systems.

Given that the majority of storage in large data centers consists of spinning disks, moving HDDs to NVMe simplifies the topologies and removes the extra translation layers of SATA and SAS. The ability to place the HDD behind a Smart NIC in a server would streamline deployment, and management, reduce required hardware, and reign in OPEX.

Additionally, for drives with multiple actuators, NVMe namespaces are a logical way to address each actuator. Unifying the interfaces between SSDs and HDDs would simplify storage stacks.

More details can be found on the OCP Storage Group site:

Join the workstream.
Check out the Project Wiki.
Subscribe to the OCP Storage Mailing list.
Additional NVMe information is available on the NVMe Specifications Overview site.

Engage with StorageReview

3 years ago

Harold Fritts

I have been in the tech industry since IBM created Selectric. My background, though, is writing. So I decided to get out of the pre-sales biz and return to my roots, doing a bit of writing but still being involved in technology.