Hello spiac,
OceanStor Dorado V6 series storage systems support disk encryption, which provides secure storage services without impacting storage performance.
The disk encryption function has the following characteristics:
1. Data in all disks is encrypted transparently without affecting other features such as mirroring, snapshot, deduplication, and compression.
2. Automatic key lifecycle management and the Key Management Interoperability Protocol (KMIP) are supported, ensuring the openness of key management systems.
If you enable Data Encryption when creating a storage pool, disk encryption is enabled. The storage system activates the AutoLock function on self-encrypting drives (SEDs) and uses the authentication keys (AKs) allocated by the key management server. SED access is protected by the AutoLock function and only the storage system itself can access its SEDs. When the storage system accesses an SED, it acquires an AK from the key management server. If the AK's hash value is consistent with that on the SED, the SED decrypts the data encryption key (DEK) for data encryption/decryption. If the AKs' hash values are different, all read and write operations will fail.
If you do not enable Data Encryption when creating a storage pool, disk encryption is disabled and the AutoLock function of SEDs is deactivated. In this case, the SEDs use the default AKs and access to the SEDs is not restricted. The SEDs can be read and written normally. Data written to the SEDs is encrypted using DEKs, regardless of whether Disk Encryption is enabled.
Key management is critical for disk encryption. OceanStor Dorado V6 series storage systems support internal key management.
A core technology for disaster recovery and a foundation that implements remote data synchronization and disaster recovery. This technology remotely maintains a set of data mirrors through the remote data connection function of the storage devices that are separated in different places. Even when a disaster occurs, the data backup on the remote storage device is not affected. Remote replication can be divided into synchronous remote replication and asynchronous remote replication.
Thanks.
