Storage Security
Storage Security is TCG's comprehensive architecture for interoperable security services on trusted storage devices. This includes self-encrypting drive behavior, access control, secure messaging, storage locking, and security subsystem classes such as Opal, Enterprise, Ruby, and Opalite.
Core capabilities
What Storage Security delivers
A common set of security services that storage devices implement consistently.
The same security model applies whether the device uses SATA, NVMe, SCSI, or another interface.
Encryption runs inside the drive itself, with no performance cost to the host.
Defined procedures for enabling security features and returning a drive to its original state.
Rules governing who can unlock a drive, and under which conditions data becomes readable.
Protected communication between the host and the storage device.
Optional capabilities that extend locking and authorization to more granular storage units.
Published test cases so implementations can be verified and certified against the specification.
[ 01 ]
A common set of security services that storage devices implement consistently.
The same security model applies whether the device uses SATA, NVMe, SCSI, or another interface.
Encryption runs inside the drive itself, with no performance cost to the host.
Defined procedures for enabling security features and returning a drive to its original state.
Rules governing who can unlock a drive, and under which conditions data becomes readable.
Protected communication between the host and the storage device.
Optional capabilities that extend locking and authorization to more granular storage units.
Published test cases so implementations can be verified and certified against the specification.
Full-disk encryption offload and hardware-backed storage protection.
Drive locking and unlocking.
Secure decommissioning or revert workflows.
Enterprise storage security policy enforcement.
NVMe namespace and SCSI LUN locking.
Protection of persistent data and recovery assets.
Interoperable storage security across heterogeneous host interfaces.
Primary features
Key capabilities of the Storage Security architecture
[ 01 ]
Storage Architecture Core Specification
[ 02 ]
Security Subsystem Classes including Opal, Enterprise, Ruby, and Opalite
[ 03 ]
Opal SSC activation and revert behavior
[ 04 ]
Locking ranges, logical port locking, configurable namespace locking, and related storage-control features
[ 05 ]
Multiparty authorization
Storage Architecture Core Specification
The foundation defining how security services are structured on storage devices.
Security Subsystem Classes including Opal, Enterprise, Ruby, and Opalite
Profiles that define which security features a drive supports, matched to its target market.
Opal SSC activation and revert behavior
Standard procedures for turning security on and returning the drive to factory state.
Locking ranges, logical port locking, configurable namespace locking, and related storage-control features
Granular control over which parts of a drive are locked and under which conditions.
Multiparty authorization
Requires more than one credential to authorize sensitive storage operations.
capability 01
Work Groups
Related TCG Work Groups that leverage Storage Security
Storage
Owns storage architecture, Security Subsystem Classes (SSCs), feature sets, secure messaging, application notes, test cases, and certification-related materials.
Trusted Platform Module (TPM)
Complements storage security through platform identity, key protection, and platform measurements.
PC Client
Applies storage security to client platform integration and endpoint protection scenarios.
Attestation
Can relate storage state and platform evidence to broader attestation workflows.
Other Work Groups
Server and Infrastructure Work Groups apply trusted storage concepts to enterprise systems, data-center platforms, and managed infrastructure.
Reference sources
Explore the Storage Security documentation
TCG Storage Architecture Core Specification
The core specification defining the architecture for security services on storage devices.
View moreStorage Security Subsystem Class: Opal
Defines the Opal SSC, the most widely deployed profile for self-encrypting drives.
View moreStorage Security Subsystem Class: Ruby
Defines the Ruby SSC, targeted at enterprise storage deployments.
View moreStorage Security Subsystem Class: Opalite
Defines the Opalite SSC, a reduced feature set for simpler storage devices.
View moreStorage Core Spec Addendum: Secure Messaging
Extends the core specification with protected host-to-device communication.
View moreReference sources
Explore the Storage Security documentation
Explore other Technologies
Trusted Platform Module (TPM)
TCG's standardized hardware Root of Trust for protecting keys, recording platform measurements and supporting attestation across every class of device.
Block Integrated Trust (BIT)
TCG's component-level hardware Root of Trust for constrained devices, giving integrated components their own identity and attestation.
Cyber Resilient Technologies (CyRes)
TCG's cyber-resilience technology for protecting persistent code, detecting unexpected states and recovering platforms to a known trusted state.
Explore other Technologies
Trusted Platform Module (TPM)
TCG's standardized hardware Root of Trust for protecting keys, recording platform measurements and supporting attestation across every class of device.
Block Integrated Trust (BIT)
TCG's component-level hardware Root of Trust for constrained devices, giving integrated components their own identity and attestation.
Cyber Resilient Technologies (CyRes)
TCG's cyber-resilience technology for protecting persistent code, detecting unexpected states and recovering platforms to a known trusted state.
Become part of TCG
Membership is open to corporations, start‑ups, government, academia, and non‑profits. Join to influence specs in Work Groups, access drafts, network with experts, and submit products for TCG Certification.