NetApp Volume Encryption (NVE) is a software-based technology for encrypting data at rest one volume at a time. An encryption key accessible only to the storage system ensures that volume data cannot be read if the underlying device is repurposed, returned, misplaced, or stolen.
Both data, including Snapshot copies, and metadata are encrypted. Access to the data is given by a unique XTS-AES-256 key, one per volume. An external key management server or Onboard Key Manager serves keys to nodes:
Starting with ONTAP 9.7, aggregate and volume encryption is enabled by default if you have a volume encryption (VE) license and use an onboard or external key manager. Whenever an external or onboard key manager is configured there is a change in how data at rest encryption is configured for brand new aggregates and brand new volumes. Brand new aggregates will have NetApp Aggregate Encryption (NAE) enabled by default. Brand new volumes that are not part of an NAE aggregate will have NetApp Volume Encryption (NVE) enabled by default. If a data storage virtual machine (SVM) is configured with its own key-manager using multi-tenant key management in an aggregate with NAE, then the volume created for that SVM is automatically configured with NVE.
You can enable encryption on a new or existing volume. NVE supports the full range of storage efficiency features, including deduplication and compression.
You can use NVE on any type of aggregate (HDD, SSD, hybrid, array LUN), with any RAID type, and in any supported ONTAP implementation, including ONTAP Select. You can also use NVE with hardware-based encryption to “double encrypt” data on self-encrypting drives.
Ordinarily, every encrypted volume is assigned a unique key. When the volume is deleted, the key is deleted with it.
Starting with ONTAP 9.6, you can use NetApp Aggregate Encryption (NAE) to assign keys to the containing aggregate for the volumes to be encrypted. When an encrypted volume is deleted, the keys for the aggregate are preserved. The keys are deleted only after the last encrypted volume in the aggregate is deleted.
You must use aggregate-level encryption if you plan to perform inline or background aggregate-level deduplication. Aggregate-level deduplication is otherwise not supported by NVE.
Starting with ONTAP 9.7, aggregate and volume encryption is enabled by default if you have a volume encryption (VE) license and use an onboard or external key manager.
NVE and NAE volumes can coexist on the same aggregate. Volumes encrypted under aggregate-level encryption are NAE volumes by default. You can override the default when you encrypt the volume.
You can use the volume move command to convert an NVE volume to an NAE volume, and vice versa. You can replicate an NAE volume to an NVE volume.
Although it is less expensive and typically more convenient to use the onboard key manager, you should set up KMIP servers if any of the following are true:
The scope of external key management determines whether key management servers secure all the SVMs in the cluster or selected SVMs only:
You can use both scopes in the same cluster. If key management servers have been configured for an SVM, ONTAP uses only those servers to secure keys. Otherwise, ONTAP secures keys with the key management servers configured for the cluster.
The following table shows NVE support details:
Resource or feature | Support details |
---|---|
Platforms | AES-NI offload capability required. See the Hardware Universe (HWU) to verify that NVE and NAE are supported for your platform. |
Encryption | Starting ONTAP 9.7, newly created aggregates and volumes are encrypted by default when you add a volume encryption (VE) and have an onboard or external key manager configured. If you need to create an unencrypted aggregate, use the following command: storage aggregate create -encrypt-with-aggr-key false If you need to create a plain text volume, use the following command: volume create -encrypt false Encryption is not enabled by default when:
|
ONTAP | All ONTAP implementations. Support for ONTAP Cloud is available in ONTAP 9.5 and later. |
Devices | HDD, SSD, hybrid, array LUN. |
RAID | RAID0, RAID4, RAID-DP, RAID-TEC. |
Volumes | Data volumes, existing root volumes, and MetroCluster metadata volumes. You cannot encrypt data on an SVM root volume. |
Aggregate-level encryption | Starting with ONTAP 9.6, NVE supports aggregate-level encryption (NAE):
|
SVM scope | Starting with ONTAP 9.6, NVE supports SVM scope for external key management only, not for Onboard Key Manager. MetroCluster is not supported. |
Storage efficiency | Deduplication, compression, compaction, FlexClone. Clones use the same key as the parent, even after splitting the clone from the parent. You are warned to rekey the split clone. |
Replication |
|
Compliance | Starting with ONTAP 9.2, SnapLock is supported in both Compliance and Enterprise modes, for new volumes only. You cannot enable encryption on an existing SnapLock volume. |
FlexGroups | Starting with ONTAP 9.2, FlexGroups are supported. Destination aggregates must be of the same type as source aggregates, either volume-level or aggregate-level. Starting with ONTAP 9.5, in-place rekey of FlexGroup volumes is supported. |
7-Mode transition | Starting with 7-Mode Transition Tool 3.3, you can use the 7-Mode Transition Tool CLI to perform copy-based transition to NVE-enabled destination volumes on the clustered system. |