Controllers in the storage array have a security key. Secure physical disks provide access to data only through a controller that has the
correct security key. When you create a secure disk pool or disk group from security-capable physical disks, the physical disks in that disk
pool or disk group become security enabled.
When a security-capable physical disk has been security enabled, the physical disk requires the correct security key from a controller to
read or write the data. All the physical disks and controllers in a storage array share security key. Furthermore, if you have both SED
physical disks and FIPS physical disks, they also share security key. The shared security key provides read and write access to the physical
disks, while the physical disk encryption key on each physical disk is used to encrypt the data. A security-capable physical disk works like
any other physical disk until it is security enabled.
Whenever the power is turned off and turned on again, all the security-enabled physical disks change to a
security locked
state. In this
state, the data is inaccessible until the correct security key is provided by a controller.
You can erase security-enabled physical disks so that you can reuse the physical disks in another disk pool, disk group, or in another storage
array. When you erase security-enabled physical disks, you ensure that the data cannot be read. When all the physical disks that you have
selected and the physical pane are security enabled, and none of the selected physical disks are part of a disk pool or disk group, the
Secure Erase
option is displayed in the
Drive
menu.
The storage array password protects a storage array from potentially destructive operations by unauthorized users. The storage array
password is independent from the Physical Disk Security feature, and should not be confused with the pass phrase that is used to protect
copies of a security key. However, Dell EMC recommends that you set a storage array password before you create, change, or save a
security key or unlock secure physical disks.
Enclosure loss protection
Enclosure loss protection is an attribute of a disk group. Enclosure loss protection guarantees accessibility to the data on the virtual disks in
a disk group if a total loss of communication occurs with a single expansion enclosure. An example of total loss of communication may be
loss of power to the expansion enclosure or failure of both RAID controller modules.
CAUTION:
Enclosure loss protection is not guaranteed if a physical disk has already failed in the disk group. In this situation,
losing access to an expansion enclosure and consequently another physical disk in the disk group causes a double physical disk
failure and loss of data.
Enclosure loss protection is achieved when you create a disk group where all of the physical disks that comprise the disk group are located
in different expansion enclosures. This distinction depends on the RAID level. If you choose to create a disk group by using the Automatic
method, the software attempts to choose physical disks that provide enclosure loss protection. If you choose to create a disk group by
using the Manual method, you must use the criteria specified below.
RAID Level
Criteria for Enclosure Loss Protection
RAID level 5 or RAID
level 6
Ensure that all the physical disks in the disk group are located in different expansion enclosures.
Because a RAID level 5 requires a minimum of three physical disks, enclosure loss protections cannot be achieved if
your storage array has less than three expansion enclosures. Because a RAID level 6 requires a minimum of five
physical disks, enclosure loss protections cannot be achieved if your storage array has less than five expansion
enclosures.
RAID level 1
Ensure that each physical disk in a replicated pair is located in a different expansion enclosure. This enables you to
have more than two physical disks in the disk group within the same expansion enclosure.
For example, if you are creating a six physical disk, disk group (three-replicated pairs), you could achieve enclosure
loss protection with only two expansion enclosures by specifying that the physical disk in each replicated pair are
located in separate expansion enclosures. This example shows this concept:
•
Replicate pair 1 — Physical disk in enclosure 1 slot 1 and physical disk in enclosure 2 slot 1.
•
Replicate pair 2 — Physical disk in enclosure 1 slot 2 and physical disk in enclosure 2 slot 2.
•
Replicate pair 3 — Physical disk in enclosure 1 slot 3 and physical disk in enclosure 2 slot 3.
82
Disk groups, standard virtual disks, and thin virtual disks
