X

An Oracle blog about ZFS Storage

  • February 4, 2015

Data Encryption ... Software vs Hardware

Software vs
Hardware Encryption,  What’s Better and Why

People often ask me, when it comes to storage (or data-at-rest)
encryption, what’s better, File System Encryption (FSE) which is done in
software by the storage controller, or Full Disk Encryption (FDE) which is done
in hardware via specialized Self Encrypting Drives (SEDs).

Both methods are very effective in providing security protection
against data breaches and theft, but differ in their granularity, flexibility and cost. A
good example of this is to compare Oracle ZFS Storage Appliance that uses very granular
File
System Encryption versus NetApp storage that uses Self Encrypting Drives
(SEDs).

Granularity and Flexibility

With ZFS Storage you can encrypt at a file system level, providing much
more granularity and security controls. For example, you can encrypt a
project, share, or a LUN, assigning different access and security levels
for different users, groups, or applications depending on the sensitivity of
the data and the security/business requirements of a particular group or
an organization.

NetApp, using Full Disk Encryption (FDE) does not have this granularity
or flexibility. As the name implies, the encryption is done at the full disk-level,
by the SED drive. So if you have only a small file to encrypt on a 4TB SED drive,
you’re stuck with 4TB granularity of that whole drive. To make things worse,
since NetApp does not support mixing SEDs/HDDs in the same disk shelf, your
granularity might be as bad as 96TB—just to encrypt a small file!.

Furthermore, FDE requires specialized self-encryption drives (SEDs)
which are not only expensive, but come only in certain capacities and
performance classes. ZFS Storage encryption, on the other hand, works with your
standard disk drives (including SSDs), independent of capacity, performance or
cost.

Cost

Self Encrypting Drives (SEDs) can be very expensive. NetApp charges
anywhere from a 40% to 60% price premium for their SEDs. For example, the price of their DS4246 disk-shelf
for FAS8000 with 24 x 4TB 7.2K encrypted drives is $51,720, whereas the same drive shelf with non-encrypted drives is $32,400 (source:
Gartner). That’s a $19,320 price difference, or a 60% price premium for encrypted drives. For the
same tray with 24 x 800GB SSDs, it’s $289,320 for encrypted SSDs vs $188,040 for non-encrypted SSDs - a $101,280, or 54%, price difference. Scaling it out to something like a petabyte
of storage, this extra cost can add up to hundreds of thousands of dollars, or
more.

Comparing this to Oracle ZFS Storage Appliance Encryption, which uses
File System Encryption and standard disk drives, the cost saving is huge. For a
dual controller (HA cluster), ZFS Encryption software is only $10,000, and that
includes local key management. It’s also capacity independent so you can scale
it to a petabyte of encrypted data or more at no extra cost. How does this
compares to NetApp? Well, if we look at 1PB of encrypted data and the above
HDD cost structure,
it would be $201,250 for NetApp and only $10,000 for ZFS Storage. For SSD’s, it would be $5.28M for NetApp and
still only $10K for ZFS Storage. That’s over 528X more for NetApp, if you’re
keeping score. .
—quite
a hefty cost difference.

Other factors ....Some might argue that hardware encryption
is faster than software encryption. Yes,
today this might be true, especially with large block sequential workloads as
encryption in general is a pretty CPU intensive process. This difference is
less with small block random workloads, and hardly any with cached reads. The ZFS Storage Appliance offers very
powerful multi-core CPUs and large amounts of DRAM to minimize these encryption
performance costs. It also offers fine granularity, so one can manage what
shares/projects to encrypt and at what level (128/192/256-bit) so as to better
manage and control both security and overall system performance. In the future,
as more and more CPUs adapt advanced encryption acceleration in their chips, I
expect this performance difference between software and hardware encryption to disappear, but not the cost, granularity, flexibility or ease of scale.

Join the discussion

Comments ( 1 )
  • guest Monday, February 16, 2015

    Post content is great to understand. Thanks for sharing.


Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.