SECURING FIBRE CHANNEL FABRICS - Brocade

Encrypting Data-in-FlightEncrypting Data-in-FlightEncrypting data-in-flight uses a different encryption method thanencrypting data-at-rest. Data-at-rest on a disk is block based, andwhen it is written back to disk the encrypted data must be exactly thesame size as the cleartext data before encryption. With data-in-flight,the data is streaming over a cable in a serial fashion and needs to beencrypted on the fly as it moves across the cable. The concepts ofstream and block ciphers were discussed in “Cryptographic Algorithms”on page 78.Data-in-flight can be found at three different points within a SAN:• Between a host and the fabric• Between two switches• Between the fabric and a storage deviceHost-to-Fabric EncryptionProtecting the confidentiality of the data exchanged between the hostserver or HBA and the fabric is accomplished by encrypting the data-inflightand can be implemented in several ways. Software-basedencryption applications can be installed on the server, but as with anysoftware-based encryption solution there will be a negative performanceimpact of 30-50%. This may be acceptable for someapplications and environments, while others may not tolerate any performancedegradation.Hardware implementation is the only implementation that does notimpact performance, but it is not a feature currently available onHBAs. The cost of implementing host-based encryption is relativelyinexpensive for small environments, but the cost increases rapidly asthe number of hosts increases in the fabric.Switch-to-Switch EncryptionThe FC infrastructure is a highly intelligent and reliable transport networkthat moves frames between servers and storage devices. All ofthe data in a SAN environment moves through this infrastructure andis usually transmitted in cleartext. As was shown in “SAN Security MythNumber 3” on page 11, data moving through a fiber optic cable can besniffed without splicing the cable or breaching its protective jacket.Data can also be moved across a public network using the FCIP protocol,which uses a TCP/IP tunnel to move an FC frame. FCIP isparticularly vulnerable since it uses the TCP/IP protocol, along with allof its associated vulnerabilities.Securing Fibre Channel Fabrics 109