Fabric OS Encryption Administrator's Guide

Fabric OS Encryption Administrator’s Guide 1
53-1002159-03
Chapter
1
Encryption Overview
In this chapter
•Host and LUN considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
•Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
•The Brocade Encryption Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
•The FS8-18 blade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
•FIPS mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
•Performance licensing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
•Recommendation for connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
•Usage limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
•Brocade encryption solution overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
•Data encryption key life cycle management . . . . . . . . . . . . . . . . . . . . . . . . . . 9
•Master key management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
•Support for Virtual Fabrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
•Cisco Fabric Connectivity support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Host and LUN considerations
Encrypting data-at-rest provides peace of mind in terms of protecting data from loss or theft, but
very careful planning must be done to ensure encrypted data is handled correctly. Much of the
planning must come from careful evaluation of host application and LUN resources, and of the
path that the data will take to get from one or more hosts to a LUN.
CAUTION
When implementing encryption for data-at-rest, all hosts that access a LUN that is to hold
encrypted data need to be configured for encryption to avoid data corruption. If a host, possibly in
another fabric, writes cleartext to an encrypted LUN, the data on the LUN will be lost. The user
must ensure that all hosts that can access a LUN are configured in the same manner.