SECURING FIBRE CHANNEL FABRICS - Brocade

Brocade Encryption Features• Data encryption key (DEK) cluster• DataFort compatibility mode• FIPS 140-2 Level 3• Common Criteria (EAL-4+)• Multi-path rekeying to a LUN through an EE• System card to enable crypto capability• Quorum authorization of sensitive operations• Access Gateway for third-party support (switch only)• LUN DecommissioningBrocade Encryption ProcessThe Brocade encryption solution uses the industry standard AES-256encryption algorithm implemented in hardware:• Disk encryption is performed using the XTS mode of encryption,which is better suited for fixed-block data• Tape encryption is performed using the GCM mode of encryption,which is better suited for variable-length and streaming dataCompression is an important component of a data-at-rest encryptionsolution for tape. Once data is encrypted, it is no longer compressible.Compression works on the principle of searching for patterns and optimizingthem. Encryption takes data and removes all patterns byrandomizing the data. Once the data is randomized and all patternsare removed, then the compression algorithm has no patterns to optimize.If encrypted data is sent directly to a tape drive, the nativecompression capabilities of that tape drive will no longer be effective.Hence, it is important to compress the data first and then send it tothe tape drive to prevent an unnecessary increase in the number oftape media used for backups.The compression algorithm used in the Brocade encryption solution isbased on a variant of the standard gzip algorithm. The compressionratio obtained using this compression algorithm may vary, like anyother compression algorithm, depending on the type of data and howcompressible it is. Data with a a great deal of white space compressesquite well, while some data may not compress at all.CryptoTarget ContainersA Crypto Target Container (CTC) is created for each storage target porthosted on a Brocade encryption device and is used to set up theencryption to a media. A CTC can be composed of only one storageSecuring Fibre Channel Fabrics 179