MegaRAID Storage Manager Online Help System

Full Disk Encryption > Terminology

Purpose

Security is a growing market concern and requirement, and customers are looking for a comprehensive storage encryption solution to protect data. You can use the FDE feature to help protect your data.

Terminology

Table 1 describes the terminology related to the FDE feature.

Terminology Used in FDE
Option
Description
Authenticated Mode
The RAID configuration is keyed to a user passphrase. The passphrase must be provided on system boot to authenticate the user and to unlock the configuration for user access to the encrypted data.
Blob
A blob is created by encrypting one or more keys using another key. There are two types of blob in the system – encryption key blob and security key blob.
Key backup
You need to provide the controller with a lock key if the controller is replaced or if you choose to migrate secure virtual disks. To do this, you must back up the security key.
Passphrase
An optional authenticated mode is supported in which you must provide a passphrase on each boot to make sure the system boots only if the user is authenticated. Firmware uses the user passphrase to encrypt the security key in the security key blob stored on the controller.
Re-provisioning
Re-provisioning disables the security system of a device. For a controller, it involves destroying the security key. For Full Disk (FDE) drives, when the drive lock key is deleted, the drive is unlocked and any user data on the drive is securely deleted. Re-provisioning does not apply to controller-encrypted drives, because deleting the virtual disk destroys the encryption keys and causes a secure erase. See Instant Secure Erase for information about the instant secure erase feature.
Security Key
A key based on a user-provided string. The controller uses the security key to lock and unlock access to the secure user data. This key is encrypted into the security key blob and stored on the controller. If the security key is unavailable, user data is irretrievably lost. You must take all precautions to never lose the security key.
Un-Authenticated Mode
This mode allows controller to boot and unlock access to user configuration without user intervention. In this mode, the security key is encrypted into a security key blob, stored on the controller, but instead of a user passphrase, an internal key specific to the controller is used to create the security key blob.
Volume Encryption Keys (VEK)
The controller uses the Volume Encryption Keys to encrypt data when a controller-encrypted virtual disk is created. These keys are not available to the user. The firmware (FW) uses a unique 512-bit key for each virtual disk. The VEK for the VDs are stored on the physical disks in a VEK blob.


DB09-000202-02 37857-00 Rev. C  August 2009
Copyright© 2009 by LSI Corporation. All rights reserved.
You can find a list of the LSI U.S. distributors, international distributors, sales offices, and design resource centers on the LSI web site at:  http://www.lsi.com/cm/ContactSearch.do