SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 11: Brocade Data Encryption Productsa DataFort compatibility mode in the Brocade encryption solution toread media previously encrypted with the DataFort appliance. TheDataFort compatibility mode can read either disk or tape media andcan also write to new tapes or existing LUNs encrypted with the Data-Fort format.The DataFort compatibility mode does several things. The Brocadeencryption device uses the ECB mode of operation for the AES-256encryption algorithm, which is used by the DataFort product. Themetadata format used by the DataFort product replaces the native formatused by the Brocade encryption device. The compressionalgorithm is the same on both platforms so there is nothing specialwhich must be done for compression.The DataFort compatibility mode enables an easy migration from theDataFort product to the new Brocade encryption solution, which willalso integrate with the NetApp LKM key management solution, or theLKM-compatible SafeNet KeySecure (in SSKM mode), alreadydeployed with the DataFort encryption appliance. However, customersusing earlier versions of the LKM, which was software-based, need toupgrade to the SafeNet KeySecure appliance now that the LKM appliancehas reached end-of-availability.Encrypting with Backup Applications. Although only the payload portionof the frame is encrypted, special considerations must be taken toadapt to each backup software vendor. There are two basic elementsin a backup solution that an encryption solution must consider.The first is how the backup application writes its metadata to the tapemedia. This is necessary to determine where to write the key informationon the media for later data recovery. Obviously, the actualcleartext key is not stored on the tape media itself, which would beequivalent to sliding a spare house key under the front porch doormat.In fact, only an index (key ID) referring to the key is written to the tapemedia as part of the tape header written by the backup application.The second consideration is how each backup application handlestape pools. Keys can be assigned either on a per-tape media basis oron a per-pool basis. As a best practice, it is preferable to assign onekey per physical tape media to reduce the rekey overhead in the eventthat a key were to be compromised. Nevertheless, for some specialcorner cases, it may be useful to use one key per pool. For instance, ifa set of tapes is planned to be sent to a third party, perhaps for auditingpurposes, a single key could be used for the entire tape set tosimplify the reading of the tapes at the other end.186 Securing Fibre Channel Fabrics