Introduction to CTE-Efficient Storage

CTE-Efficient Storage for Linux is a licensed feature available with CTE 7.0.0 or later. In addition, all CTE Agents must be registered with a CipherTrust Manager v2.6, or a subsequent version.

Note

All references to ‘storage array’ in this document assume storage array systems capable of supporting CTE-Efficient Storage functionality.

With CTE-Efficient Storage, CTE offers the same degree of security for the data stored on the arrays while offering a new type of encryption key and GuardPoint. The new type of key enables storage array systems to achieve storage efficiencies with encrypted data streams. The coordination between the storage array and CTE is essential for achieving storage efficiency with encrypted data.

In the context of this solution, a LUN exported from a storage array system to a CTE-managed host, is referred to as an ES GuardPoint. An ES GuardPoint is a guarded device configured with the CTE-Efficient Storage capability.

Requirements and Considerations

• CTE-Efficient Storage requires XTS-AES mode of the AES algorithm for encryption.

• CTE only supports CTE-Efficient Storage on servers with microprocessors integrated with Advanced Encryption Standard instruction set (AES-NI).

• CTE-Efficient Storage requires that the encryption keys be stored in the KMIP server on the CipherTrust Manager. Therefore, all hosts on which you want to create ES GuardPoints must be registered with a KMIP-enabled domain in theCipherTrust Manager.

  

  Note

  You can also use In-Place Data Transformation to protect storage arrays without needing to store the encryption keys in the KMIP server. For details, see CipherTrust In-Place Data Transformation for Linux.