Self-Encryption Drive (SED)

A self-encryption drive (SED) opens a communication session between the SED and a key management server. An identifier of the SED is sent to the key management server, where the identifier uniquely identifies a data structure in a database associated with the key management server and the data structure comprises a timestamp and a media encryption key (MEK). The data structure is received from the key management server, the data structure being wrapped with a shared session key associated with the communication session. The data structure is unwrapped with the shared session key and the MEK is stored only in the volatile memory of the SED based on the timestamp. Data is encrypted for storage in the non-volatile storage media of the SED based on the MEK stored only in the volatile memory of the self-encryption drive (SED). The MEK stored only in the volatile memory of the SED is erased to crypto-erase the SED.