HP is pleased to introduce disk encryption for the HP StorageWorks XP24000 and HP StorageWorks XP20000 Disk Arrays. This white paper describes the encryption feature including the background of what the challenge is that the product addresses, what the feature consists of and how it is ordered.
HP StorageWorks XP24000 and XP20000
Disk Array encryption
Table of contents HP StorageWorks XP24000 and XP20000 Disk Array encryption............................................................. 2 Introduction ..................................................................................................................................... 2 XP Disk encryption-The challenge it addresses................................................................................... 2 The Encryption solution ..................................................................................................................... 3 Acquiring XP encryption.................................................................................................................... 3 For more information............................................................................................................................ 4 HP StorageWorks XP24000 and XP20000 Disk Array
encryption
Introduction HP is pleased to introduce disk encryption for the HP StorageWorks XP24000 and HP StorageWorks XP20000 Disk Arrays. This white paper describes the encryption feature including the background of what the challenge is that the product addresses, what the feature consists of and how it is ordered.
XP Disk encryption-The challenge it addresses Customers store their most important mission-critical data on XP disk arrays. If some of that data were to fall into the wrong hands, either through an accidental or malicious incident, customers could be at risk of embarrassment, customer dissatisfaction, and even possibly legal implications. While XP disks are in normal operation, they are typically in physically secure data center environments. When XP disk drives fail they are replaced by HP with good drives. The failed drives are taken by HP service personnel, tested and either destroyed or repaired and refurbished and returned to use in the HP XP customer base. If a drive were to be accidentally lost or maliciously removed from the repair stream, it is possible, but unlikely, that a skilled computer expert could find and reconstruct some customer data from a partially failed drive. Historically, due to the secure processes for handling these failed drives by HP, there is no known incident of such a data breach occurring, but there is a possibility of such an event occurring. There is also a possibility that an unauthorized person with access to the computer facility could locate an XP cabinet key, open an operating XP Disk Array, and remove a number of XP disk drives. Again, there is no record of such an event occurring, but it possible.
2 The Encryption solution To provide extreme security to data stored in an XP by eliminating the possibility of such a security breach resulting in unauthorized access to data stored in an XP, HP has introduced a new encryption feature to the XP24000 and XP20000 disk arrays. With the encryption feature in place and enabled, data written to the XP will be encrypted by the processors that write the data to the disk. If a drive is removed from the array, either as a failed drive or through unauthorized access, the data on the drive will be completely meaningless to anyone attempting to read the data. As the data passes through the XP, the final step is for the data to be written to disk by a processor referred to as a DKA, or disk control adapter. The HP new encryption feature allows the DKA to apply an Electronic Codebook Advanced Encryption Standard 256-bit encryption algorithm to the data before it is written to disk. When the data is read from disk the same DKA decrypts the data, so it can be used by the host which owns the data. There is no measurable performance impact to the array from either the encryption or decryption of the data. Encryption is enabled or disabled on a per-parity group basis. There is a single encryption key per disk array. The encryption key is securely stored in the management station of the array using a key encryption key. The XP's data movement utility, XP AutoLUN, can move data between an unencrypted parity group and an encrypted parity group to facilitate migration of data into a fully secured or encrypted configuration.
Acquiring XP encryption The new encryption feature is sold as part of a new DKA model by HP. Customers can add the encryption feature to existing XP24000 or XP20000 arrays, or they may purchase it new with new disk array... [download for more]
