Your Browser is Out of Date

Nytro.ai uses technology that works best in other browsers.
For a full experience use one of the browsers below
PowerProtect DD Series Appliances: Encryption Software
Executive summary DD series encryption software Configuring DD Encryption Enabling and disabling DD Encryption Key management File system lock Changing the encryption algorithm DD Encryption with DD Replicator DD Encryption and Cloud Tier
DD Encryption and Cloud Tier
Conclusion Technical support and resources

DD Encryption and Cloud Tier

Home > Data Protection > PowerProtect DD Series Appliances > White Papers > PowerProtect DD Series Appliances: Encryption Software > DD Encryption and Cloud Tier

DD Encryption and Cloud Tier

  • DD Encryption can be enabled at three levels: system, active tier, and cloud unit. Encryption of the active tier is only applicable if encryption is enabled for the system. Cloud units have separate controls for enabling encryption. Follow these steps to enable DD encryption for cloud units:

    1. Click Data Management > File System > DD Encryption.

    Note: If no encryption license is present on the system, the Add Licenses page is displayed.

    1. In the DD Encryption panel, perform one of the following actions: 
    • To enable encryption for Cloud Unit X, click Enable.
    • To disable encryption for Cloud Unit X, click Disable.

    Note: You are prompted to enter security officer credentials to enable encryption.

    1. Enter the security officer Username and Password. 
    2. Optionally, check Restart file system now. 
    3. Click Enable or Disable, as appropriate. 
    4. In the File System Lock panel, lock or unlock the file system. 
    5. In the Key Management panel, click Configure. 
    6. In the Change Key Manager window, configure the security officer credentials and the key manager. 

    Note: Cloud encryption is allowed only through the Embedded Key Manager. External key managers are not supported.

    1. Click OK. 
    2. Use the DD Encryption Keys panel to configure the encryption keys. 

    If encryption is enabled for the cloud tier, any data written to the cloud or buckets is encrypted using the Embedded Key Manager (eKM) keys. The data is encrypted on the DD series appliance before it is written to the cloud. There is no end-to-end encryption, but data is always encrypted throughout the data movement.  

    If the encryption is disabled on the cloud tier, data is decrypted on the DD series appliance before it is sent over a TLS connection to the cloud. If the encryption is enabled on the cloud-provider side (for example, using ECS native encryption), the data is encrypted when it reaches that end point. Similarly, the data is decrypted at the endpoint and is transmitted over TLS when it is recalled or read from the DD series appliance.

    Note: When using an embedded key manager, only the newly ingested data is encrypted. For example, encryption occurs for data that is ingested after embedded encryption is enabled, unless you run the Apply changes command. This command converts or encrypts all the existing unencrypted data.