Page 179
MegaRAID SAS Software User Guide Chapter 5: MegaRAID Command Tool
| SafeStore Security Options
5.7 SafeStore Security
Options
Use the commands in this section to manage the SafeStore Security feature. This
feature offers the ability to encrypt data on disks and use disk-based key management
to provide data security. With this feature, data is encrypted by the drives. You can
designate which data to encrypt at the individual virtual drive (VD) level.
This solution provides data protection in the event of theft or loss of physical drives.
With self-encrypting disks, if you remove a drive from its storage system or the server it
is housed in, the data on that drive is encrypted and useless to anyone who attempts to
access without the appropriate security authorization.
Any encryption solution requires management of the encryption keys. This feature
provides a way to manage these keys. You can change the encryption key for all
ServeRAID controllers that are connected to SED drives. All SED drives, whether locked
or unlocked, always have an encryption key. This key is set by the drive and is always
active. When the drive is unlocked, the data to host from the drive (on reads) and from
the host to the drive cache (on writes) is always provided. However, when resting on
the drive platters, the data is always encrypted by the drive.
In the following options, [E0:S0, E1:S1] specifies the enclosure ID and slot ID for the
drive.
See Chapter 3, SafeStore Disk Encryption for more information about the SED feature.
5.7.1 Use Instant Secure Erase on a
Physical Drive
Use the command in the following table to perform an Instant Secure Erase of data on a
physical drive. The Instant Secure Erase feature lets you erase data on SED drives.
5.7.2 Secure Data on a Virtual Drive Use the command in the following table to secure data on a virtual drive.
Table 28: Use Instant Secure Erase on a Physical Drive
Convention MegaCli -PDInstantSecureErase
-PhysDrv[E0:S0,E1:S1,...] | [-Force]
-aN|-a0,1,2|-aALL
Description Erases the data on a specified drive or drives.
-PDInstantSecureErase: Use the Instant Secure Erase feature to
erase data on a drive or drives.
-PhysDrv[E0:S0,...]: Specifies the drive(s) that you want to
perform the Instant Secure Erase on.
-Force: Specifies that the MegaCLI utility does not ask you for
confirmation before it performs this command (you might lose data
using this option with some commands).
NOTE: NOTE: Previously -szXXX expressed capacity in MB but now you can
enter the capacity in your choice of units. For example, to create a virtual
drive of 10 GB, enter the size as sz10GB. If you do not enter a unit, by default
it is considered as MB.
Table 29: Secure Data on a Virtual Drive
Convention MegaCli -LDMakeSecure -Lx|-L0,1,2,...|-Lall
-aN|-a0,1,2|-aALL
Description Secures data on a specified virtual drive or drives.
To Next Page
Loading...
