Brocade Fabric OS Encryption Administrator's Guide Supporting Fabric OS v6.2.0 (53-1001201-04, May 2009)

Encryption Administrator’s Guide 1

53-1001201-04

Chapter

Encryption overview

In this chapter

•Host and LUN considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

•Encryption configuration tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

•Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

•The Brocade encryption switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

•The FS8-18 blade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

•Performance licensing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

•Recommendation for connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

•Usage limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

•Brocade encryption solution overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

•Data encryption key life cycle management . . . . . . . . . . . . . . . . . . . . . . . . . 10

•Key management systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

•Encryption switch initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Host and LUN considerations

Encrypting data-at-rest provides peace of mind in terms of protecting data from loss or theft, but

very careful planning must be done to ensure encrypted data is handled correctly. Much of the

planning must come from careful evaluation of host application and LUN resources, and of the

path that the data will take to get from one or more hosts to a LUN.

ATTENTION

When implementing encryption for data-at-rest, all hosts that access a LUN that is to hold encrypted

data need to be configured for encryption to avoid data corruption. If a host, possibly in another

fabric, writes cleartext to an encrypted LUN, the data on the LUN will be lost. The user must ensure

that all hosts that can access a LUN are configured in the same manner.