1-3
Cisco MDS 9000 Family NX-OS Storage Media Encryption Configuration Guide
OL-29289-01
Chapter 1 Storage Media Encryption Overview
About SME
Transparent Fabric Service
Cisco employs a Fibre Channel redirect scheme that automatically redirects the traffic flow to an
MSM-18/4 module, a MDS 9222i switch, or a SSN-16 module anywhere in the fabric. There are no
appliances in-line in the data path and there is no SAN rewiring or reconfiguration.
Encryption
SME uses strong, IEEE-compliant AES 256 encryption algorithms to protect data at rest. Advanced
Cisco MDS 9000 SAN-OS and NX-OS software security features, such as Secure Shell (SSH), Secure
Sockets Layer (SSL), RADIUS, and Fibre Channel Security Protocol (FC-SP) provide the foundation
for the secure architecture.
SME uses the NIST-approved random number standard to generate the keys for encryption.
Encryption and compression services are transparent to the hosts and storage devices.
Encryption Algorithms
The IEEE-approved standard for encryption of disk drives is IEEE 1619—Standard Architecture for
Encrypted Shared Storage Media (1619.1 for tape drives). It specifies the XTS encryption mode
commonly used for disk encryption. The IEEE Security in Storage Working Group (SISWG) was
investigating the possibility of submitting the XTS mode to NIST for consideration as an Approved
Mode of Operation for FIPS 140-2 certification. It uses a narrow-block encryption algorithm, and the
standardization process for a wide-block algorithm is currently in progress as 1619.2. Other encryption
algorithms for consideration are LRW-AES and AES-CBS. Draft versions of the IEEE 1619 standard
had used LRW-AES, which was later replaced by XTS-AES.
SME Roles
SME services include the following four configuration and security roles:
•
SME Administrator
•
SME Storage Administrator
•
SME Key Management Center (KMC) Administrator
•
SME Recovery Officer
The SME Administrator configures and maintains SME. This role can be filled by multiple storage
network administrators. The SME Storage Administrators are responsible for SME provisioning
operations and the SME KMC Administrators are responsible for the SME KMC administration
operations. The security officer may be assigned the SME KMC Administrator role in some scenarios.
Note
SME Administrator role includes the SME Storage Administrator and the SME KMC Administrator
roles.
The SME Recovery Officers are responsible for key recovery operations. During SME configuration,
additional Recovery Officers can be added. SME Recovery Officers play a critical role in recovering the
key database of a deactivated cluster and they are responsible for protecting the master key. The role of
the SME Recovery Officer separates master key management from SME administrations and operations.
In some organizations, a security officer may be assigned to this role.
