Dell EMC PowerVault MD 34XX/38XX Series Storage Arrays Administrator's Guide

Physical disk security

Physical Disk Security is a feature that prevents unauthorized access to the data on a physical disk that is physically removed from the storage array. A security-capable physical disk encrypts data during writes and decrypts data during reads using a unique encryption key. Security-capable physical disks can be either Self-Encrypting Disk (SED) or Federal Information Processing Standard (FIPS) physical disks.

To implement Physical Disk Security, perform the following steps:

1. Equip your storage array with security-capable physical disks—either SED physical disks or FIPS physical disks.

2. Create a security key that is used by the controller to provide read/write access to the physical disks.

3. Create a security-enabled disk pool or disk group.

Controllers in the storage array have a security key. Secure physical disks provide access to data only through a controller that has the correct security key. When you create a secure disk pool or disk group from security-capable physical disks, the physical disks in that disk pool or disk group become security enabled.

When a security-capable physical disk has been security enabled, the physical disk requires the correct security key from a controller to read or write the data. All the physical disks and controllers in a storage array share security key. Furthermore, if you have both SED physical disks and FIPS physical disks, they also share security key. The shared security key provides read and write access to the physical disks, while the physical disk encryption key on each physical disk is used to encrypt the data. A security-capable physical disk works like any other physical disk until it is security enabled.

Whenever the power is turned off and turned on again, all the security-enabled physical disks change to a security locked state. In this state, the data is inaccessible until the correct security key is provided by a controller.

You can erase security-enabled physical disks so that you can reuse the physical disks in another disk pool, disk group, or in another storage array. When you erase security-enabled physical disks, you ensure that the data cannot be read. When all the physical disks that you have selected and the physical pane are security enabled, and none of the selected physical disks are part of a disk pool or disk group, the Secure Erase option is displayed in the Drive menu.

The storage array password protects a storage array from potentially destructive operations by unauthorized users. The storage array password is independent from the Physical Disk Security feature, and should not be confused with the pass phrase that is used to protect copies of a security key. However, Dell EMC recommends that you set a storage array password before you create, change, or save a security key or unlock secure physical disks.