Access Conditions

Overview

Access conditions are objects, introduced by the MEK-MPA extension to TCG Opal, that represent an abstract condition an entity wants to validate before enabling access to data within a storage device. An access conditions column may hold zero or more access conditions, and they gate the ability to change a range's read-lock and write-lock states. Each condition encapsulates the secret material used to enable access.

Initializing an access condition requires sealing the access key to the specific operation and the specific access condition being executed, preventing misuse of the encapsulated material. A condition stays disabled by default until it is explicitly enabled and provisioned. Crucially, security cannot be removed once an access condition is enabled, so read-lock and write-lock must both be set true for the global range before any access condition is assigned. Admin-configured conditions (set via the pending access conditions column) seal the next generated MEK, while user-configured conditions let a customer VM merge its own conditions with the admin conditions to fully seal an MEK.