the storage anarchist

4.009: leading from the front

Earlier this week, IDC published the results of its  Storage User Demand Study, 2011 — Spring Edition: Unlocking the Minds of Storage Users. Among their findings this year was a notable use of outsourced storage, emerging demand for FCoE (but with limited commitment to the technology), and a predominant preference for midrange and modular storage.

Surveyed users also forecasted that little would change in the way they utilize storage subsystems over the coming year. If true, I would think this bodes well for EMC, especially in light of the results of two key findings presented the SUDS, 2011 report.

4.008: truth or d@re

Back in December 2010, EMC’s Enterprise Storage Division (ESD) released a major new software update for VMAX, embodied as Enginuity 5875. Among the more than 50 new features was  the Data at Rest Encryption feature (which we internally abbreviate as “D@RE”). And then back in May, we updated D@RE with support for RSA’s external key manager as a complement to the embedded RSA key manager in the original release.

Admittedly, Data at Rest Encryption is a feature that is offered by very few storage platforms – it is almost exclusively found only on enterprise-class arrays, in fact. And of all the implementations, Symmetrix VMAX’s D@RE implementation is highly differentiated – a breed apart from would-be competitors (as is FAST VP, VMAX’s automated storage tiering implementation, but that’s not today’s story).

Separating VMAX D@RE from everyone else  are features such as:

• Support for any and all drive types supported by VMAX. Where some other implementations are limited to offering encryption only on special drives with built-in encryption, VMAX D@RE encrypts all the data on all the Flash EFD drives, enterprise 10K and 15K HDDs, and 7200rpm “slow-spin” HDDs;
• A unique key for each and every drive in the system. With up to 2400 unique keys in a full-blown VMAX, the life of a crypto-criminal is much more difficult, especially as compared to competitive offerings that support a max of 31 keys for the entire array (the more data protected by a single key, the easier it is to find the key);
• Complete and transparent data at rest encryption for any and all hosts, applications and storage services, including Virtual Provisioning, FAST VP, SRDF, TimeFinder, VAAI, etc.
• Automated assignment of unique keys to every replacement drive and rekeying of data as the drives are rebuilt;
• Virtually undetectable performance overhead for either encryption or decryption (see chart at right);
• The ability to remove the keys from the array altogether when physically relocating the array as added protection against the accidental or malicious loss of the array (or drives) during the move. Deliver the array and the keys to the new locale separately, and restart the array without delay after the two are reunited.

To my knowledge, no other enterprise storage array offers all of these native capabilities of VMAX D@RE.

Arguable, I could stop there. But wait…

It gets BETTER!