Silicon Graphics InfiniteStorage 4000 Series, Configuring And Maintaining

Page: 52 / 276

40 Drive Security with Full Disk Encryption
The hot spare must be the same type of drive as the drive that failed (for example, a
Serial Advanced Technology Attachment [SATA] hot spare cannot replace a Fibre
Channel hot spare).
You can assign drives to act as hot spares manually or have the script commands
automatically assign hot spares. If you manually assign a drive to be a hot spare, you
must identify the drive by tray ID and slot ID. When you let the script commands
automatically assign hot spares, you must enter the number of hot spares that you
want in the storage array.
Drive Security
with Full Disk
Encryption Drive Security is a premium feature that prevents unauthorized access to the data on a
drive that is physically removed from the storage array. Controllers in the storage
array have a
security key
. Secure drives provide access to data only through a
controller that has the correct security key. Drive Security is a premium feature of the
storage management software and must be enabled either by you or your storage
vendor.
The Drive Security premium feature requires
security capable
drives. A security
capable drive encrypts data during writes and decrypts data during reads. Each
security capable drive has a unique drive encryption key.
When you create a
secure volume group
from security capable drives, the drives in
that volume group become security enabled. When a security capable drive has been
security enabled, the drive requires the correct security key from a controller to read
or write the data. All of the drives and controllers in a storage array share the same
security key. The shared security key provides read access and write access to the
drives, while the drive encryption key on each drive is used to encrypt the data. A
security capable drive works like any other drive until it is security enabled.
Whenever the power is turned off and turned on again, all of the security-enabled
drives change to a
security locked
state. In this state, the data is inaccessible until the
correct security key is provided by a controller.
You can view the Drive Security status of any drive in the storage array from the
Drive Properties
dialog. The drive can have one of these capabilities:

Security Capable

Secure – Security enabled or disabled

Read/Write Accessible – Security locked or unlocked
You can view the Drive Security status of any volume group in the storage array by
using the
show volume group
command. The volume group can have one of
these capabilities:

Security Capable

Secure
The following table shows how to interpret the security properties status of a volume
group.