Dell PowerVault ME5 Series Administrator's Guide

Securing the system with FDE

The Full Disk Encryption panel (Settings > System > Security) provides options for you to enable FDE protection to secure all of the user data on a storage system. To secure the system, all disks must be FDE-capable.

The Security panel indicates whether or not the system is secured. To secure the system, click Secure System to enter a passphrase that will enable the system to write to and read from FDE-capable disks. The system uses the passphrase to generate a lock key ID that is used to secure the FDE-capable disks. If the system is unable to interpret the lock key on the FDE-capable disk, the encrypted data on the disk is inaccessible.

Once the passphrase is entered and confirmed, the System Status will indicate that the system is secured and the Security panel will provide options to:

• Change the passphrase. Enter a new passphrase.
• Lock the system for transport. Lock down the disks in preparation for transport. Use this option when the system will not be under your physical control. After the system has been transported and powered up, the system and disks will enter the secured, locked state; disks will be in the UNUSABLE state:
  • For virtual configurations, pools and disk groups will be unavailable. To restore access to encrypted data, enter the passphrase for the system's lock key ID. Disk groups will be dequarantined, pool health will be restored, and volumes will become accessible
  • For linear configurations, disk-groups will be unavailable. To restore access to encrypted data, enter the passphrase for the system's lock key ID. Disk groups will be dequarantined, health will be restored, and volumes will become accessible

Lock keys are generated from the passphrase and manage locking and unlocking the FDE-capable disks in the system. Clearing the lock keys and power cycling the system denies access to encrypted data on the disks. If the lock keys are cleared while the system is secured, the system will enter the FDE lock-ready state, in preparation for the system being powered down and transported.