Dell EMC PowerVault MD 34XX/38XX Series Storage Arrays Administrator's Guide

Self Encrypting Disk (SED) technology prevents unauthorized access to the data on a physical disk that is physically removed from the storage array. The storage array has a security key. Self encrypting disks provide access to data only through an array that has the correct security key.

The self encrypting disk or a security capable physical disk encrypts data during writes and decrypts data during reads.

You can create a secure disk group from security capable physical disks. When you create a secure disk group from security capable physical disks, the physical disks in that disk group become security enabled. When a security capable physical disk has been security enabled, the physical disk requires the correct security key from a RAID controller module to read or write the data. All the physical disks and RAID controller modules in a storage array share security key. The shared security key provides read and write access to the physical disks, while the physical disk encryption key on each physical disk is used to encrypt the data. A security capable physical disk works like any other physical disk until it is security enabled.

Whenever the power is turned off and turned on again, all the security enabled physical disks change to a security locked state. In this state, the data is inaccessible until the correct security key is provided by a RAID controller module.

Table 1. Interpretation of security status of disk groupThe following table shows how to interpret the security status of a disk group:

Secure	Security Capable - Yes	Security Capable - No
Yes	The disk group is composed of all SED physical disks and is in a Secure state.	Not applicable. Only SED physical disks can be in a Secure state.
No	The disk group is composed of all SED physical disks and is in a Non-Secure state.	The disk group is not entirely composed of SED physical disks.

The Secure Physical Disks option is inactive with a check mark to the left if the disk group is already security enabled.

You can erase security enabled physical disks so that you can reuse the physical disks in another disk group or in another storage array. When you erase security enabled physical disks, ensure that the data cannot be read. When all the physical disks that you have selected in the Physical Disk type pane are security enabled, and none of the selected physical disk is part of a disk group, the Secure Erase option is displayed in the Hardware menu.

The storage array password protects a storage array from potentially destructive operations by unauthorized users. The storage array password is independent from self encrypting disk, and should not be confused with the pass phrase that is used to protect copies of a security key. However, it is good practice to set a storage array password.