SECURING FIBRE CHANNEL FABRICS - Brocade

Brocade Encryption for Data-In-FlightBrocade Encryption for Data-In-FlightData-in-flight refers to data that is in transit. Data-in-flight could bemoving across a copper cable, dark fiber, or even through the air usingwireless devices. Data-in-flight poses a different problem from a dataconfidentiality perspective, particularly when it is transported over publicnetworks. Data transported between two remote sites using an FCIPtunnel over a public network can be vulnerable if it is sent in cleartextformat. The Brocade 7800 Extension Switch and Brocade FX8-24Extension Blade support FCIP tunneling and address the data confidentialityissue by encrypting data using the well-known IPSec protocol.Brocade 7800 and FX8-24The Brocade 7800 Extension Switch and equivalent FX8-24 ExtensionBlade are capable of connecting two fabrics over great distances usingthe FCIP protocol. An FCIP tunnel is created between two sites, whichare connected together over a public IP-based WAN. Since the WAN isa public network, there is always a risk of data transferred over such anetwork being sniffed by an unauthorized user. To protect the FCIP tunnelfrom a sniffing attack, the data-in-flight over the WAN should beencrypted. This can be done using the IPSec protocol.Table 14 shows the different encryption and authentication algorithmssupported with the Brocade implementation of IPSec for FCIP.Table 1. IPSec encryption and authentication algorithms for FCIPEncryption Algorithm3DESAES-128 (default)AES-256Authentication AlgorithmSHA-1MD5AES-XCBCData-at-Rest Solution for Data-In-Flight ProblemIt is possible to use the Brocade data-at-rest encryption solution toencrypt data-in-flight over distance with proper design.Data being replicated or sent over a dark fiber from the primary datacenter to the DR data center can be encrypted using a data-at-restencryption solution. If the encryption device and host is located in theprimary data center and the storage is at the secondary site then theencryption device would encrypt the frame payload before sending itover the dark fiber connection. At this point, the payload is encryptedand cannot be read if captured along the way. This technique is oftenSecuring Fibre Channel Fabrics 195