Security and operational efficiency continue to top the data center needs lists of IT executives. Dell Technologies looks at the complete solution to achieve both so that customers can focus on their business outcomes.

Dell PowerFlex is a software-defined storage platform designed to significantly reduce operational and infrastructure complexity. PowerFlex empowers organizations to move faster by delivering flexibility, elasticity, and simplicity, with predictable performance and resiliency at scale. PowerFlex provides a unified fabric of compute and storage, with scale-out flexibility for either of these ingredients to match workload requirements, with full lifecycle simplification provided by PowerFlex Manager. PowerFlex Enterprise Encryption and KeyStore Services (PEEKS), a data encryption and key management solution known as CloudLink, supports workload deployments from edge to core to cloud, providing a perfect complement to the PowerFlex family by enabling flexible encryption tailored to the needs of the modern data center.

With increasing regulatory and compliance requirements, more and more customers now realize how critical encryption is to securing their data centers. These customers need solutions that are built into their platforms. PowerFlex PEEKS, integrated with PowerFlex, provides reliable data encryption and key management in a single solution, with the flexibility to satisfy the needs of most customers. 

The rich feature set of PowerFlex PEEKS integrates directly into the PowerFlex platform, allowing customers access to the encryption and key management functionality of PowerFlex PEEKS, including data-at-rest and data-in-motion encryption, full key lifecycle management, and lightweight multi-tenancy support.

PowerFlex provides flexible security levels according to the needs of the customer.

Federal Information Processing Standard (FIPS) publications 140-2 and 140-3 require access control and physical security mechanisms for storing the data and the keys as part of a module validation to security level 2. PowerFlex enables this security level by using cryptographic modules validated by the Cryptographic Module Validation Program (CMVP) as part of the data-at-rest feature, customer key management services (KMS), and supported hardware security module (HSM) key stores and protectors for protecting the keys.

PowerFlex Data at Rest Encryption (D@RE) protects data from hacking, inside threats, and theft, ensuring that only those with authorized access are allowed to use the data. PowerFlex users can enable D@RE with the option to choose software encryption or key management for self-encrypting drives (SEDs). 

The SED encryption uses AES-256 XTS for D@RE. 

Figure 1.   PowerFlex D@RE

PowerFlex PEEKS offers software encryption and key management for PowerFlex via direct agent deployment and integration with PowerFlex storage nodes, where the agent leverages the dm-crypt library of the underlying operating system to encrypt the storage block volume data. Encryption operations are completely transparent to the applications deployed on the physical and virtual machines that consume the storage. Encryption for PowerFlex is licensed per raw capacity TB and allows the management of up to 1,000,000 keys for device encryption.

When the agent is deployed on PowerFlex for software encryption, it interfaces with the native encryption library, directing it to encrypt configured block volumes and providing the necessary encryption keys to accomplish this task. Configuration of this encryption occurs within PowerFlex PEEKS Center.

All encryption/decryption operations are performed using dm-crypt libraries. PowerFlex PEEKS manages and controls what and where encryption occurs. The encryption of the data occurs after PowerFlex has handled any processing of the data and before the data is sent to be stored at rest on the physical devices.

Data decryption occurs before the data is presented to PowerFlex for processing and returned to the user.

Encryption keys are required to perform data encryption/decryption, and it is critical to keep these keys safe. When the data is first encrypted, the PowerFlex PEEKS agent requests an encryption key from PowerFlex PEEKS Center. This key, called a data encryption key (DEK), is generated and stored encrypted within PowerFlex PEEKS Center (or, optionally, on a configured third-party KMS) along with a corresponding key ID. The DEK and DEK ID are returned to the requesting agent, where the agent furnishes dm-crypt with the key and adds the DEK ID to the storage device encryption header. The DEK ID is saved in the storage device encryption header.

Figure 2.   CloudLink /PowerFlex PEEKS Center 

This methodology enables PowerFlex PEEKS Center to ensure that the requesting DEK ID is valid for the device, and that it is safe to release the DEK to the agent. The dm-crypt libraries use the DEK, which is temporarily stored in memory cache, for all runtime encryption/decryption operations. When the storage node is restarted, the memory cache is cleared, and the agent must retrieve the DEK ID from the device and request the DEK from PowerFlex PEEKS Center.

For a PowerFlex deployment leveraging SEDs, the PowerFlex PEEKS agent is once again deployed and integrated into the PowerFlex platform storage node to take over key management for each individual SED. Key management for SEDs is licensed per node containing SEDs and allows for the management of up to 1,000,000 encrypted device keys.

Self-encrypting drives are what they seem to be: a storage device that directly handles the encryption activities. In this use case, the drives themselves generate the data encryption keys (DEKs), but the DEKs need to be stored securely inside the SED. This is where PowerFlex PEEKS steps in.

Once again, the PowerFlex PEEKS agent is deployed on the storage node, and this time the agent discovers each of the SEDs and furnishes a key encryption key (KEK) to the device. This KEK is used to encrypt the DEK, where it is stored locally on the device in an encrypted state. Upon request from the agent, the KEK is generated and stored encrypted within PowerFlex PEEKS Center (or, optionally, on a configured third-party KMS), along with the corresponding key ID. The KEK and KEK ID are returned to the requesting agent, where the agent identifies and furnishes the SED with the ID and key. The KEK ID is linked to information found within the SED.

This methodology enables PowerFlex PEEKS Center to ensure that the requesting KEK ID is valid for the device and that it is safe to release the KEK to the agent. When the storage node is restarted, the memory cache is cleared, and the agent must retrieve the KEK ID from the device and request the KEK from PowerFlex PEEKS Center. If the SEDs are restarted, the agent must refurnish the KEKs to the drives.

Figure 3.   PowerFlex D@RE – SDS encryption

FIPS PUB 140-2 is required by federal agencies when cryptographic-based information security features are used to provide confidentiality, integrity and availability for information and information systems. Information security features are features that provide protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Product cryptographic features that protect sensitive information and information systems require the use of FIPS PUB 140-2-validated cryptographic modules.

PowerFlex D@RE uses SED drive encryption, leveraging self-encrypting drives that are validated for FIPS 140-2 security level 2. The active certification is #3965.

PowerFlex D@RE protects the data using encryption keys and key encryption keys. The keys must be stored securely to protect them from unauthorized access. PowerFlex stores the keys using PowerFlex PEEKS Center, a locked-down virtual appliance.

PowerFlex supports both internal and external key stores and key protectors. The PEEK vault that PowerFlex uses for the internal key store and key protector is part of the PowerFlex PEEK option. For the external key store and key protector, PowerFlex PEEK integrates with the KMS and HSM of the customer using the key management interoperability protocol (KMIP) to allow physical key protection. PowerFlex manages secure communications with third-party HSM key stores using CMVP-validated encryption libraries and algorithms    

Figure 4.   Flexible key stores and key protectors

FIPS 140-2 approved and validated algorithms support RSA key generation and TLS session encryption and message authentication to the PowerFlex PEEKS server. The active certification is #4305.

FIPS 140-2 approved and validated algorithms are used to provide TLS session encryption and message authentication for the following:

• Host server for the PowerFlex PEEKS Center web user interface, Rest API, and database synchronization.
• Host server for agent data transmission, the KMIP server, and client data transmission.
• The generation of RSA TLS private keys and certificates public key values.
• AES key generation for D@RE and secure storage.

PowerFlex provides the option to store keys on third-party HSM devices that implement CMVP-validated FIPS 140-2 level 2 or level 3 cryptographic modules.

Dell Technologies and the authors of this document welcome your feedback on the solution and the solution documentation. Contact the Dell Technologies Solutions team by email. 

Author: Aharon Blitzer

Contributors: Richard Bishop, Lejin Du