Self Encrypting Drives BrickStor can leverage TCG FIPS 140-2 certified self-encrypting drives for increased security. To manage the keys and disks within BrickStorOS does require a special license from RackTop and appropriate FIPS drives. TCG licensed systems may come with drives encrypted using a factory generated key. Self-Encrypting Drives placed in a system that are not licensed will not lock when power is removed. TCG Must be licensed and the Key Manager must be properly configured before you can utilize this feature BrickStor SP supports local and external key management. See Encryption and Key Management for more details. Drive Enrollment Once the key manager is configured drives can be enrolled in the system. Each drive will receive a unique key used to unlock the self-encrypting drive known as the key encryption key (KEK) from the key manager and configure the drive to auto lock when power is removed from the drive. To enroll drives or a pool in the system go to the hardware view page of the UI. If you select a drive that is not in a pool you can select multiple drives and enroll the ones you choose to enroll. If you select a drive that is already a member of a pool it will enroll all drives that are a member of that pool. Other Self Encrypting Drive Operations Unenroll – Removes drive from SED management and sets the drive to default PIN and sets the drive to stay unlocked. Rekey –Requests a new key from the key manager and changes the KEK PIN on the drive. Verify Key – Verify the KEK unlocks the drive and is available from the key management service. Export Keys – Will provide a password protected file with the KEK PINS that can be imported later for backup purposes or to another node so that the other node can unlock the drives. This is required in HA using the internal key management service. Import Keys – Allows you to import keys that were exported from the same node or another node into the internal key management database. This is performed for HA nodes to share keys between the heads. This can also be used to import keys to a replacement head node. Exporting and Backing Up Keys When using the BrickStor internal key manager it is important to back up the keys and store them in an alternate location. The /etc/racktop/keymgrd.conf file allows users to set the location of the internal key file. The configuration file also allows users to configure the BrickStor to rotate KEKs on a scheduled internal. This is only recommended when using an external key manager in order to ensure you have backup copies of the keys. Cryptographically Erasing SEDs Users can Crypto Erase SEDs which will reset the pins and put them in an unenrolled state. To manage the drive again just enroll the drive. As part of a pool destroy users can select the crypto erase option. This option is irreversible. Data is permanently destroyed and unrecoverable. However, if you don’t select the crypto erase option the data is potentially recoverable in the future off each drive. If the KEK PIN has been lost for a drive a crypto erase is the only option to put the drive back into a usable state because the drive will become erased and unlocked. SED Protection on the Main Pane Under the general tab of BrickStor SP Manager users can perform various SED configuration options as well review reports about which drives are enrolled in SED management and the current status of each drive.