Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 316

Security is not compromised. Array Y cannot unlock the drive because it needs the SEDset key from array X. The drive can be manually converted to a spare, and doing so will instantly erase it. 7. SED array is operating normally. A drive and a controller are removed. Security is not compromised on the drive. The SEDset key cannot be found on the controller, even if it is pulled from a running system. However, cached data might be found in the controller's battery-backed RAM, which is not protected by SED or any other encryption. 8. SED array with 16 slots is populated with 8 SEDs. Then, 8 new SEDs are added. Assume the array includes 6 active drives and 2 spares. Initially, the SEDset spans the 6 active drives, so 3 drives must be lost before the key is compromised. As new drives are inserted, the SEDset resecures itself with each addition. Eventually, the SEDset spans all 14 active drives, so 7 drives must be lost before the key is compromised. Self-Encrypting Drives (SED) Advanced Encryption Advanced encryption for SEDs includes the following methods: • Media encryption key and access key • Threshold secret sharing and local keying Media Encryption Key and the Access Key This encryption method is as secure but much more flexible than encrypting directly with the access key. The access key can be changed without affecting the encrypted data, because the Media Encryption Key remains unchanged. If data were encrypted with the access key, as in the past, then changing the key would destroy data. Likewise, overwriting the Media Encryption Key does destroy data, resulting in an instantaneous cryptographic erasure of the entire drive. If a SED is not configured with an access key, then data is readable as if the drive were not self-encrypting. If a SED is configured with an access key, then the access key must be provided to unlock the drive, which remains unlocked only while powered. The drive locks itself upon losing power or shutting down, and the access key must be provided again. This information also applies to partitions of a SED (called bands by the Trusted Computing Group [TCG]). Each partition has its own Media Encryption Key and optional access key (called a BandMaster by the TCG). AutoSED configures a small unsecured band for drive labels, followed by a single secured band spanning the rest of the drive. This access key is the key that is protected by AutoSED. Threshold Secret Sharing and Local Keying The AutoSED feature is a self-contained keying system, requiring no external Key Management Service (KMS). Exclusive to Dell, automatic local keying relies upon the concept of cryptographic secret sharing as discovered by Adi Shamir and specified in the Internet Draft Threshold Secret Sharing by David McGrew (draft-mcgrew-tss-03). When a SED member is initially configured, AutoSED generates a new and unique access key. Every drive in the system is locked with this one key. Then, the Shamir algorithm is used to split the key into any number of pieces, called shares, which have the following properties: 1. For each set of shares, you can choose how many shares are needed to recover the key (for instance, 2-out-of-3 or 10-outof-20). This number is the threshold. 2. Every time the key is split into a set of shares, the shares will be different even though the key stays the same. Shares can be combined only with shares from the same set; they are incompatible with shares from any other set. 3. Shares disclose no information about the key until the threshold is reached. AutoSED always chooses to split the key such that one share is written to each active drive in the system (that is, non-spare, nonfailed, non-foreign drives). The threshold is always half that number; more precisely, it is (n+1)/2. Therefore, the SEDset can automatically unlock itself whenever half of the drives are present. For the same reason, an adversary must possess half of the drives from the same SEDset to unlock it. 316 About Self-Encrypting Drives (SEDs) and AutoSED