## TS7770 Disk Encryption 

The TS7770 must be requested with encryption when it is ordered, which results in the CSB Distributed RAIDs (DRAID) being encrypted at creation time because encryption cannot be enabled later. For countries in which encryption cannot be requested, a TS7770 can be ordered without encryption. 

For local encryption the following points apply: 

GLYPH<SM590000> Local encryption includes four USB drives to store encryption keys. Two of the drives must be attached to the CSB during start and two are used as backup keys. Customer policy dictates where these keys are safe guarded. 

GLYPH<SM590000> Rekey for Local encryption needs support to assist because USB drives must be moved during the process. 

For external encryption the following points applies: 

GLYPH<SM590000> ISKLM KMIP with TLS 1.2 support (distributed ISKLM only) TLS V1.2 must be configured on the Key Manager Server. 

GLYPH<SM590000> The customer must exchange certificates and trust them on the Key Manager server and TS7770 by using the Management Interface (MI). 

GLYPH<SM590000> After external encryption is enabled, the customer can perform a rekey from MI. 

The TS7770 cache model 3956-CSB supports data-at-rest encryption, which is defined by the following characteristics: 

GLYPH<SM590000> Data-at-rest means that the data is encrypted on the end device (drives) by way of software and hardware. 

GLYPH<SM590000> The algorithm that is used is the Advanced Encryption Standard (AES) US government standard from 2001. 

GLYPH<SM590000> Encryption of data-at-rest complies with the Federal Information Processing Standard 140 (FIPS-140) standard, but is not certified. 

GLYPH<SM590000> Ciphertext stealing XTS-AES-256 is used for data encryption. 

GLYPH<SM590000> AES 256 is used for master access keys. 

GLYPH<SM590000> The algorithm is public; the only secrets are the keys. 

GLYPH<SM590000> A symmetric key algorithm is used. The same key is used to encrypt and decrypt data. 

The encryption of system data and metadata is not required; therefore, they are not encrypted. Through hardware encryption, data is encrypted by using serial-attached SCSI (SAS) hardware. This method protects against the potential exposure of sensitive user data that is stored on discarded, lost, or stolen media. Data is encrypted or unencrypted when it is written to or read from internal drives (hardware encryption). 

The following types of keys are used to encrypt the drives and are defined in the system: 

GLYPH<SM590000> Master access key: 

– The master access key is created when encryption is enabled. 

– The master access key can be stored on USB flash drives or key servers. One master access key is created for each enabled encryption key provider. 

– It can be copied or backed up as necessary. 

– It is not permanently stor ed anywhere in the system. 

– It is required at start to unlock access to encrypted data. 

