Data Encryption - Fujitsu ETERNUS DX80 S2 User Manual

Chapter 3 Setup

3.4 Data Encryption

3.4 Data Encryption
Encrypting data as it is being written to the drive prevents information leakage caused by fraudulent
decoding.
Even if a drive is removed and stolen by malicious third parties, data cannot be decoded.
The encryption function only encrypts the data stored on the drives, so server access results in the
transmission of plain text. Therefore, this function is effective against leakage of data being transferred via
sneaker net, but has no effect on data leakage via server access.
The following two types of data encryption are supported:
• Self Encrypting Drive function
This function encrypts data by using Self Encrypting Drives (SEDs).
SEDs are locked the instant that they are removed from the storage system, which ensures no data is read
or written with these drives. This encryption prevents information leakage from drives that are stolen or
replaced for maintenance. This function also reduces discarding costs because SEDs do not need to be
physically destroyed.
• Volume conversion encryption function
This function encrypts data on a volume basis by using the firmware of the ETERNUS DX Disk storage
system.
Encryption can be performed in volume units according to the importance of the data. No additional
hardware is required to perform volume encryption.
The restrictions and notes on encrypting data are described below.
■
Self Encrypting Drive function
For the procedure to perform data encryption using Self Encrypting Drives (SEDs), refer to "ETERNUS Web GUI
User's Guide" or "ETERNUS CLI User's Guide".
• Register the SED authentication key before installing SEDs in the ETERNUS DX Disk storage system. If a SED
is installed without registering the SED authentication key, data leakage in a SED that is removed may
occur.
• The common key can only be set once in the ETERNUS DX Disk storage system. This key can be used for all
the SEDs that are installed in the ETERNUS DX Disk storage system. The common key cannot be changed or
deleted after being set. The common key is used to authenticate RAID groups when key management
server linkage is not used.
ETERNUS DX80 S2/DX90 S2 Disk storage system User's Guide -Operation-
48
Copyright 2013 FUJITSU LIMITED P3AM-4842-12ENZ0