What are the common storage virtualization encryption standards and how do they differ?

1 Data-at-rest encryption

Data-at-rest encryption is the practice of encrypting the data when it is stored on a disk or other media. This can prevent data breaches in case the storage device is lost, stolen, or compromised. There are two main types of data-at-rest encryption: self-encrypting drives (SEDs) and software-based encryption. SEDs are hardware devices that have a built-in encryption engine and key management system. They encrypt and decrypt the data automatically and transparently, without requiring any additional software or configuration. Software-based encryption, on the other hand, relies on a software application or a hypervisor to perform the encryption and decryption functions. Software-based encryption can be more flexible and customizable, but it may also consume more CPU and memory resources and affect the performance of the storage system.

2 Data-in-transit encryption

Data-in-transit encryption is the practice of encrypting the data when it is transferred over a network or a bus. This can prevent data interception, modification, or impersonation by malicious actors. There are different protocols and methods for data-in-transit encryption, depending on the type and level of communication. For example, Transport Layer Security (TLS) and Secure Sockets Layer (SSL) are widely used protocols for encrypting the data between a client and a server over the internet. Fibre Channel Security Protocol (FC-SP) and Internet Protocol Security (IPsec) are examples of protocols for encrypting the data between storage devices and switches over a SAN or a LAN. Data-in-transit encryption can also be implemented at the application layer, using encryption APIs or libraries.

3 Data-in-use encryption

Data-in-use encryption is the practice of encrypting the data when it is processed or accessed by an application or a user. This can prevent data exposure or leakage in case the application or the user is compromised or malicious. Data-in-use encryption is the most challenging and complex type of encryption, as it requires the data to be encrypted and decrypted on the fly, without affecting the functionality or the performance of the application or the user. There are emerging technologies and techniques for data-in-use encryption, such as homomorphic encryption, secure multi-party computation, and trusted execution environments. However, they are still in the research or development stage and not widely adopted in the storage virtualization context.

4 Encryption standards and compliance

Encryption standards are specifications or guidelines that define how encryption should be implemented and performed. They can cover aspects such as algorithms, key sizes, key management, modes of operation, and interoperability. Encryption standards can be developed by various organizations, such as industry associations, government agencies, or international bodies. Some examples of encryption standards are Advanced Encryption Standard (AES), Data Encryption Standard (DES), Triple DES (3DES), RSA, and Elliptic Curve Cryptography (ECC). Encryption standards can help ensure the quality, security, and compatibility of encryption solutions. Encryption compliance is the requirement or expectation that encryption solutions should adhere to certain standards or regulations. Encryption compliance can be driven by various factors, such as industry best practices, customer demands, or legal obligations. Some examples of encryption compliance are Payment Card Industry Data Security Standard (PCI DSS), Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), and Federal Information Processing Standards (FIPS). Encryption compliance can help ensure the protection, privacy, and integrity of data and meet the needs and expectations of stakeholders.

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?