ONTAP Hardware

FlashCache and NSE

NeilMurphy
4,531 Views

Hi All,

 

I'm just reviewing the FlashCache and FlashPool SE presentation (search for "SE presentation Flash Cache" on Field Portal) and I read that FlashCache is "not a good option with NetApp Storage Encryption (NSE) systems".

 

Does anyone have a technical explanation of why this is?

 

Cheers,

Neil.

1 ACCEPTED SOLUTION

NeilMurphy
4,390 Views

I just got this update from another guy on the NetApp technical marketing team:

 

In my experience, customers who want the FIPS 140-2 Level 2 validated encryption of NSE systems require persistently-cached data to be encrypted as well. Since NSE systems rely on the drives (HDDs and SSDs) to encrypt data at rest, Flash Pool with encrypting SSDs in the only hybrid FAS configuration that meets this requirement.

View solution in original post

7 REPLIES 7

Damien_Queen
4,514 Views

I believe that recommendation based on the assumption that FlashCache is not encrypted and might be a way to access (some) of the encrypted data.

NeilMurphy
4,508 Views

Hi Damien,

Yep, I was thinking that might be the reasoning but then I was trying to think of a way that data in the cache could be accessed without going through the host that has direct access to the underlying volume and I can't see how that could be done easily (although, where there's a will...). I wonder is there any other reson why it's not recommended.

Cheers,

Neil.


Damien_Queen
4,507 Views

Even though FlashCache looses its data during reboot, it doesn’t mean data couldn’t be restored with advanced techniques.

There are no other reasons for my knowledge.

 

You can try to reach the person who made the presentation to ask what he/she means by “not best suitable”.

NeilMurphy
4,502 Views

Hi Damien,

 

I went with your suggestion and emailed the team responsible for the content of the presentation (ng-aff-fas-tme@netapp.com).  I'll post their reply here when I get it.

One of the reasons for my confusion is that the presentation says that  you can use Flash Cache with NVE. But surely the problem of data being held in FlashCache in unencrypted form is still there? Or maybe not?

 

Cheers,

Neil.

NeilMurphy
4,487 Views

Just got this reply from the team:

 

"NSE drives are FIPS 140-2 Level 2 validated.  FIPS 140-2 Level 2 requires physical security measures (e.g. tamper resistant screws, security chips, etc) as opposed to Level 1 which is software only. 

NVE is FIPS 140-2 Level 1 validated.

 

Does that help?"

 

I've been told to always recommend Flash Pool with NSE as it's apparently the only available option. Not really a technical explanation and it doesn't help those of us in regions where FIPS doesn't apply.

NeilMurphy
4,391 Views

I just got this update from another guy on the NetApp technical marketing team:

 

In my experience, customers who want the FIPS 140-2 Level 2 validated encryption of NSE systems require persistently-cached data to be encrypted as well. Since NSE systems rely on the drives (HDDs and SSDs) to encrypt data at rest, Flash Pool with encrypting SSDs in the only hybrid FAS configuration that meets this requirement.

NeilMurphy
4,355 Views

My final update on this subject. I just found this buried in a slide deck presented at Insight 2018:

 

Flash Cache - "Cached blocks are encrypted when NetApp Volume Encryption (NVE) is used, but not on NetApp Storage Encryption (NSE) FAS systems"

 

Flash pool - "Cached blocks are encrypted when NVE is used and with NSE systems"

Public