Dell DR2000v DR Series System Administrator Guide - Page 146

Configuring and Using Encryption at Rest, Understanding Encryption at Rest

Get Dell DR2000v PDF manuals and user guides View all Dell DR2000v manuals
Add to My Manuals
Save this manual to your list of manuals

Page 146 highlights

13 Configuring and Using Encryption at Rest This chapter introduces the concept of Encryption at Rest as used by the DR Series system as well as related concepts and tasks. NOTE: Due to export regulations, the encryption at rest feature is not available in certain markets, and, therefore, may not be available in your locale. Refer to the subsequent topics for more information. Understanding Encryption at Rest Data that resides in the DR Series system can be encrypted. When encryption is enabled, the DR Series system uses the Industry standard FIPS 140-2 compliant 256-bit Advanced Encryption Standard (AES) encryption algorithm for encrypting and decrypting user data. The content encryption key is managed by the key manager, which operates in either a Static mode or an Internal mode. In Static mode, a global, fixed key is used to encrypt all data. In internal mode, key lifecycle management is performed in which the keys are periodically rotated. The minimum key rotation period before the content encryption key can be rotated and a new key is generated is 7 days. This rotation period is user-configurable and can be specified in days. A user-defined passphrase is used to generate a pass phrase key, which is used to encrypt the content encryption keys. It is mandatory to define a passphrase to enable encryption. The system supports up to a limit of 1023 different content encryption keys. All streams of a data-store are encrypted or re-encrypted with the same content encryption key. DR Series system statistics report the amount of data encrypted and decrypted bytes consistently. Encryption at Rest Terminology This topic introduces and briefly defines some basic encryption at rest terminology used in the DR Series system documentation. Term Passphrase Content encryption key Key management mode Description A passphrase is a sequence of words or other text used to control access to data, similar to a password in usage, but is generally longer for added security. In the DR Series system, the passphrase is userdefined and is used to generate a passphrase key that encrypts the file in which the content encryption keys are kept. The passphrase is a human readable key, which can be up to 256 bytes in length. It is mandatory to define a passphrase to enable encryption. The key used to encrypt the data. The content encryption key is managed by the key manager, which operates in either a static mode or an internal mode. The system supports up to a limit of 1023 different content encryption keys. The mode of key lifecycle management as either static or internal. Static mode A global mode of key management in which a fixed key is used to encrypt all data. 146

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
13
Configuring and Using Encryption at Rest
This chapter introduces the concept of Encryption at Rest as used by the DR Series system as well as related concepts
and tasks.
NOTE:
Due to export regulations, the encryption at rest feature is not available in certain markets, and, therefore,
may not be available in your locale.
Refer to the subsequent topics for more information.
Understanding Encryption at Rest
Data that resides in the DR Series system can be encrypted. When encryption is enabled, the DR Series system uses the
Industry standard FIPS 140-2 compliant 256-bit Advanced Encryption Standard (AES) encryption algorithm for encrypting
and decrypting user data. The content encryption key is managed by the key manager, which operates in either a Static
mode or an Internal mode. In Static mode, a global, fixed key is used to encrypt all data. In internal mode, key lifecycle
management is performed in which the keys are periodically rotated. The minimum key rotation period before the
content encryption key can be rotated and a new key is generated is 7 days. This rotation period is user-configurable
and can be specified in days. A user-defined passphrase is used to generate a pass phrase key, which is used to
encrypt the content encryption keys. It is mandatory to define a passphrase to enable encryption. The system supports
up to a limit of 1023 different content encryption keys. All streams of a data-store are encrypted or re-encrypted with the
same content encryption key. DR Series system statistics report the amount of data encrypted and decrypted bytes
consistently.
Encryption at Rest Terminology
This topic introduces and briefly defines some basic encryption at rest terminology used in the DR Series system
documentation.
Term
Description
Passphrase
A passphrase is a sequence of words or other text used to control
access to data, similar to a password in usage, but is generally longer
for added security. In the DR Series system, the passphrase is user-
defined and is used to generate a passphrase key that encrypts the file
in which the content encryption keys are kept. The passphrase is a
human readable key, which can be up to 256 bytes in length. It is
mandatory to define a passphrase to enable encryption.
Content encryption key
The key used to encrypt the data. The content encryption key is
managed by the key manager, which operates in either a static mode or
an internal mode. The system supports up to a limit of 1023 different
content encryption keys.
Key management mode
The mode of key lifecycle management as either static or internal.
Static mode
A global mode of key management in which a fixed key is used to
encrypt all data.
146