Nov 11, 2015

EMC Data Domain Replicator - Encryption

Replicator




Because there is a variety of IT centers and visions for how long vaulting should work, EMC offers a wide variety of options for deploying different topologies cost-effectively.
From centralized support of remote office backup over a WAN, to protecting larger peer data centers, all of these configurations are available

The main benefits provided by DD replicator licensing include network efficient asynchronous IP replication, easy integration with existing backup and archive applications.
Another benefit includes environments and extensive feature set for “real world” enterprise providing the greatest deployment flexibility.




Data Domain replicator licensing supports replication and includes the addition of an SSL-based encrypted replication capability. This functionality is included at no additional charge and available to customers that have a DD replicator license and a valid support contract.
Once the source and destination systems have authenticated, secure replication connections are established using the standard SSL protocol, which encrypt data and metadata using 256-bit AES key strength. The encrypted replication has a minimum performance impact, and the capability works concurrently with DD encryption of data at rest.

Encryption



Increased levels of publicized loss of tape and disk-based backups coupled with compliance mandates are driving the need for customers to encrypt their data at rest. The Data Domain encryption software option provides a way for organizations to secure the data that resides on their Data Domain systems.
There are two types of encryption. Encryption for data in flight means encryption as data is transported. Only at the source and the destination is the data's true meaning apparent. Encryption for data at rest involves data that is physically stored in an encrypted manner, such that the data can be removed or copied and taken to another environment. It cannot be accessed without decrypting it.





The benefits and goals of Data Domain encryption are to protect against theft or loss of the system in transit; to protect against theft or loss of physical storage media; to allow failed drives to be returned to factory securely; and to provide adequate data encryption security to meet basic compliance regulations. DD encryption encrypts all system data at rest in the physical storage to provide adequate encryption key management to ensure key integrity and security.
Encryption of data-at-rest (standard DD Encryption or integration with DPM) is not supported for systems with DD Extended Retention software option.





When deduplication is involved there are challenges. There are three approaches to encrypt before deduplication, which leads to poor compression. You can encrypt after deduplication with an adjunct gateway solution (additional hardware is required in this circumstance and it is complex to manage). You can employ integrated deduplication and encryption. This is the best of both worlds with security and space savings, but it is not easily implemented and requires architecture suited to in-line deduplication such as that provided by Data Domain systems.




Data Domain's in-line encryption provides real-time data encryption with deduplication, and immediate data protection. There is no post-processing encryption which is safer and more secure. Data is encrypted immediately. There is no window of exposure and the process is predictable and simple. Data Domain in-line encryption also involves SISL architecture, leveraged for optimized encryption. With the same level of deduplication provided to non-encrypted, the software-based approach requires no additional hardware

Useful Link:







 
 




Posted by at

3 comments:

Subscribe to: Post Comments (Atom)