Self Encrypting Drives BrickStor SP allows using TCG FIPS 140-2/140-3 certified Self-Encrypting Drives (SED) for increased security. SED drives use 256-bit hardware encryption to protect data at rest by self-locking on demand or when the disks are powered off. Utilizing the SED functionality requires an additional license. This license allows the user to configure, automate, and replicate keys as desired. It allows you to crypto erase a disk. BrickStor will unlock disks as needed at power-up, as well as on demand as well. Non-TCG licensed disks operate as standard drives which allow any computer to read/write to the disk. They use a factory generated key to encrypt data, and since the disk never locks, it is always readable/writable. You will also have to insure proper data sanitization methods when you migrate or retire a disk. With TCG licensing, DoD-compliant data sanitization of a disk can be done in seconds. This is because all that one has to do is change the encryption key for the drive, and then all data is instantly scrambled. TCG Must be licensed and the Key Manager must be properly configured before you can utilize this feature BrickStor SP supports local and external key management. See Encryption and Key Management for more details. Drive Enrollment Once the key manager is configured drives can be enrolled in the system. Each drive will receive a unique key used to unlock the self-encrypting drive known as the key encryption key (KEK) from the key manager and configure the drive to auto lock when power is removed from the drive. To enroll drives or a pool in the system go to the hardware view page of the UI. If you select a drive that is not in a pool you can select multiple drives and enroll the ones you choose to enroll. If you select a drive that is already a member of a pool it will enroll all drives that are a member of that pool. Other Self Encrypting Drive Operations Unenroll – Removes drive from SED management and sets the drive to default PIN and sets the drive to stay unlocked. Rekey –Requests a new key from the key manager and changes the KEK PIN on the drive. Verify Key – Verify the KEK unlocks the drive and is available from the key management service. Export Keys – Will provide a password protected file with the KEK PINS that can be imported later for backup purposes or to another node so that the other node can unlock the drives. This is required in HA using the internal key management service. Import Keys – Allows you to import keys that were exported from the same node or another node into the internal key management database. This is performed for HA nodes to share keys between the heads. This can also be used to import keys to a replacement head node. Exporting and Backing Up Keys When using the BrickStor internal key manager it is important to back up the keys and store them in an alternate location. The /etc/racktop/keymgrd.conf file allows users to set the location of the internal key file. The configuration file also allows users to configure the BrickStor to rotate KEKs on a scheduled internal. This is only recommended when using an external key manager in order to ensure you have backup copies of the keys. Cryptographically Erasing SEDs Users can Crypto Erase SEDs which resets the pins and puts them in an unenrolled state. We also send a special series of commands to the disk to change the encryption key for the disk. All data is instantly (nearly) scrambled on the disk. Enroll it again and you can use the drive. If you do not enroll it, you can still use the drive, but the drive will not lock on power-off. Your data will then be readable/writable on any computer you plug the drive into. You should always crypto erase a drive when you retire it. You should always attempt to crypto erase a failed/failing drive. As a crypto-erase doesn’t overwrite the media and changes the encryption/decryption password, it is entirely possible that 100% of the data will be destroyed even on a severely crippled disk. If the KEK PIN has been lost for a drive a crypto erase is the only option to put the drive back into a usable state because the drive will become erased and unlocked. SED Protection on the Main Pane Under the general tab of BrickStor SP Manager users can perform various SED configuration options as well review reports about which drives are enrolled in SED management and the current status of each drive.