Overview
ISO/IEC 14776-481:2019 - titled Information technology - Small Computer System Interface (SCSI) - Part 481: Security features for SCSI commands (SFSC) - specifies a security framework for protecting SCSI command and parameter data. The standard defines a common security model for SCSI devices, mechanisms for creating and managing Security Associations (SAs), key derivation functions, and transport encapsulations (e.g., ESP-SCSI). It also standardizes SCSI SECURITY PROTOCOL IN/OUT command formats, capability descriptors, certificate and compliance data, and procedures for SA negotiation using an IKEv2-like exchange adapted for SCSI (referred to as IKEv2‑SCSI).
Key topics and technical requirements
The standard covers these core technical areas (as reflected in the table of contents):
- Security model common to all device types - definitions, conventions, and the overall SA lifecycle.
- Security Associations (SAs) - principles, parameters, creation, deletion, and progress indication.
- Key Derivation Functions (KDFs) - multiple KDF approaches including IKEv2-based iterative KDFs and HMAC/AES-XCBC variants.
- IKEv2‑SCSI protocol - device/server capability exchange, key exchange steps, authentication (pre-shared keys, digital signatures, certificate handling), and shared-key generation.
- ESP‑SCSI encapsulations - formats and procedures for encrypting and authenticating SCSI CDBs and data buffers (with treatment of initialization vectors and descriptors).
- Security protocol parameters - CDB descriptions, supported protocol lists, certificate formats (public key and attribute certificates), secure random number usage, and compliance descriptors (e.g., FIPS 140 references).
- Operational details - payload formats, parameter data formats, and command-level specifications for SECURITY PROTOCOL IN/OUT.
Practical applications and who should use it
ISO/IEC 14776-481 is targeted at organizations that implement, integrate, or operate SCSI-based storage systems and need standardized command-level security:
- Storage array and RAID vendors - to implement command and parameter encryption/authentication for device-to-host and host-to-device interactions.
- Firmware and device driver developers - to support SECURITY PROTOCOL IN/OUT, SA management, and ESP-SCSI encapsulation formats.
- SAN/NAS architects and system integrators - to design secure storage networks that incorporate key exchange and certificate-based authentication.
- Security architects and compliance teams - to align storage command protection with organizational policies and certification requirements (e.g., FIPS references).
- OEMs and data center operators - to mitigate command-level attack vectors and protect metadata/control-plane data in transit.
Related standards and protocols
- Other parts of the ISO/IEC 14776 (SCSI) family for device-specific behavior and command sets.
- IKEv2 and IPsec concepts (IKE/ESP) - IKEv2‑SCSI and ESP‑SCSI adapt these established cryptographic exchange and encapsulation ideas for SCSI command security.
- Cryptographic and certificate standards referenced in parameter and certificate handling sections.
Keywords: ISO/IEC 14776-481, SCSI security, SFSC, IKEv2‑SCSI, ESP‑SCSI, Security Associations, key derivation functions, SECURITY PROTOCOL IN OUT, storage command encryption.
Open preview (PDF)Information technology — Small computer system interface (SCSI) — Part 481: Part 481:Security Features for SCSI Commands (SFSC)
