Solid State Drive Security For HP Printing Devices

Transcription

1 Solid State Drive Security For HP Printing Devices Summary: This document discusses Solid State Drive (SSD) technology used in HP printers and MFPs, and discusses the impact to security feature availability. Contents: SSD Security Considerations... 2 SSD Technology... 2 Secure Erase Data Overwrite Functionality Not Supported... 2 SSD Impact to Disc Management Features... 2 Managing Temporary Job Files... 2 Erase Job Data... 3 Encryption... 3 Secure Erase... 3 RAM Drive Storage of Job data... 4 Accessory Drive Option for Job Data... 4 Appendix A: Device List... 6 February 11 th 2011 Version 1.1 Public

2 SSD Security Considerations HP printing devices now use Solid State Drive (SSD) mass storage devices on some models. SSD storage devices do not support all of the existing security features of traditional hard disk drives (HDD). For high security environments and security sensitive applications, HP recommends Selecting models that include a HDD (See Appendix A, Device List) Migrate Job data to a system RAM disk (See RAM Drive Storage of Job Data) Adding an optional HDD when supported (See Accessory Drive Option for Job Data) SSD Technology Solid State Drives (SSD) are mass storage devices that use NAND-based flash memory instead of spinning disks used in traditional hard disk drives (HDD). These memory based drives appear to the printing device operating system as a traditional Hard Disk Drive. SSDs have operational characteristics that affect some security features present in traditional HDD enabled devices. Secure Erase Data Overwrite Functionality Not Supported Due to the nature of Flash memory operation, SSDs are not able to securely delete files by directly overwriting their data as can be done with a hard disk drive. The following SSD read / write characteristics prevent the implementation of HP s Secure Erase Data Overwrite feature to securely delete files on an ongoing basis. SSD controllers use a technique called wear leveling to evenly distribute data across all flash blocks in the SSD. This causes data previously written to be moved dynamically to different locations when writing new data. The previous data locations cannot be tracked for overwriting. SSD write amplification behavior also causes the SSD controller to dynamically relocate previously written data. Data is written to flash locations using 4 to 8 KB pages, but must be erased in blocks of typically 256KB. Existing data is relocated to free entire blocks for erasure, as flash needs to be erased before it can be written again. SSD Impact to Disc Management Features The following security features are impacted when using SSD as the device system disk. Managing Temporary Job Files This feature controls how temporary job files are erased at the completion of print, copy, fax, or digital send jobs. SSD devices do not support the following erase modes: o Secure Fast Erase (Overwrite 1 time) o Secure Sanitizing Erase (Overwrite 3 times) Figure 1: Managing Temporary Job Files option using an SSD system disk in the Embedded Web Server 2 Public

3 Erase Job Data This feature erases all job data files stored on the system disk including temporary data for print, copy, fax, , and send to network folder jobs, Stored Jobs, and Stored Fax jobs SSD devices do not support the following erase modes: o Secure Fast Erase (Overwrite 1 time) o Secure Sanitizing Erase (Overwrite 3 times) Figure 2: Erase Job Date option using an SSD system disk in the Embedded Web Server Encryption The current generation of SSD used in HP printing devices does not support encryption. This option will be included in future releases. Secure Erase The current generation of SSD used in HP printing devices does not support ATA Secure Erase, which clears all addressable and spared storage. However, executing the Secure Erase command will manually clear all addressable memory locations marking all cells as empty. This erase mode is only accessible from the pre - boot menus. Because the SSD acts as the system drive containing the operating system firmware, performing a Secure Erase will render the device inoperable, and a new firmware image must be installed before the device can be used again. 1 Secure Erase 2 Erase / Unlock 3 Get Statuses Figure 3: Secure Erase in device Pre - boot Menu 3 Public

4 RAM Drive Storage of Job Data Job data can be stored in the RAM drive of HP single function printers instead of the SSD system drive. This allows all job data including temporary job files from print and copy jobs, and Stored Jobs to be securely deleted by power cycling the printing device. Note: Stored Jobs and temporary job data are not cleared at each power cycle from the SSD as with non- FutureSmart Firmware devices that do not contain a HDD. RAM Drive storage is enabled by selecting the drive and clicking the Use option. All existing job data is then transferred to the RAM Drive external drive, and that point forward all job data including temporary files for print and scan jobs use the accessory drive instead of the SSD system drive. Figure 4: RAM Drive settings in the Embedded Web Server Note: A RAM Drive has limited storage equal to about 10 monochrome pages. Drive full issues may occur more frequently than with other drive types. Accessory Drive Option for Job Data A second hard drive can be added to SSD enabled devices to store all customer job data and making available all existing HDD security features. All existing customer job data is transferred to the external drive automatically. From that point forward all job data including temporary files for print and scan jobs use the accessory drive instead of the SSD system drive. Figure 5: Accessory Drive settings in the Embedded Web Server 4 Public

5 The accessory drive can be securely erased independently of the SSD system drive. Two erase operations are available. If the drive is an HP Secure Disk encrypted hard drive, a cryptographic erase can be performed. Secure Disk Erase selects the most secure method to remove the drives data, other than a cryptographic erase. The method will either be a Secure Erase using data overwrite or an ATA Secure Disk Erase Figure 6: Accessory Drive Erase command in Hard Disk Status of EWS Figure 7: Erase options for accessory drive in the Embedded Web Server (EWS) 5 Public

6 Appendix A: Device List The following HP printing devices have SSD enabled models HP Color LaserJet CP5525 SSD bundles: CP5525n CP5525dn HDD bundles: CP5525xh HP LaserJet Enterprise M4555 MFP SSD Bundles: Base bundle (EMEA only) HDD bundles: M4555h M4555f M4555fskm 2011 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. February 2011 Version Public