topic Re: Self Encrypting SAS HDD with Smart Array P411 in Disk Enclosures

Self Encrypting SAS HDD with Smart Array P411

robertcompton — Fri, 18 Oct 2013 10:12:27 GMT

Good morning,

I'm trying to find out if it is possible to use self encrypting SAS HDD's housed in a StorageWorks D2600 and connected to my DL380 G7 via a Smart Array P411 controller.

I cannot see any mention of self encryption being supported by the P411 in any of the literature I've seen.

My aim is to swap out the current SAS HDD's and replace them all with self encrypting ones instead. The main reason is that I want to remove the encryption load from the servers CPU and hand it over to the hardware on the HDD instead.

Does anyone know if this scenario is at all possible?

Regards

RobC

Re: Self Encrypting SAS HDD with Smart Array P411

Dennis Handly — Sat, 19 Oct 2013 02:10:30 GMT

>replace them all with self encrypting ones instead.

Unless you have software that "takes ownership" of the SEDs, there is no protection of data.

The SEDs will be quite happy to encrypt on writes and decrypt on reads.

Re: Self Encrypting SAS HDD with Smart Array P411

robertcompton — Mon, 21 Oct 2013 08:32:37 GMT

Hi Dennis,

Thanks for the response. I know SED's encrypt/decrypt all the time. The point of SED's is for them to be encrypted and data is unatainable - or at least much harder to obtain - should the drives be stolen or an incorrect key is entered at system boot time.

SED's seem like a great idea by removing the encryption load from the CPU to the HDD but it seems like the technology is too new to be able to get infromation from vendors.

I'd still appreciate it anyone can tell me if my proposed set up will work.

Regards

RobC

Re: Self Encrypting SAS HDD with Smart Array P411

Dennis Handly — Mon, 21 Oct 2013 09:51:57 GMT

>The point of SEDs is for them to be encrypted and data is unattainable - should the drives be stolen or an incorrect key is entered at system boot time.

Yes. You must have software to take ownership of the drive. This includes changing the authentication key and to set lock on powerfail. And as you said, software to read the key and unlock the band.