Quest has been named as an ASP "Ten Best Web Support Sites" award winner. Learn more.

Rapid Recovery 6.0.2 - User Guide

*** Legend Introduction to Dell Data Protection | Rapid Recovery Understanding the Rapid Recovery Core Console Working with repositories Managing Rapid Recovery Core settings Using custom groups Working with encryption keys Protecting machines using the Rapid Recovery Core Working with Microsoft Exchange and SQL Servers Protecting server clusters Exporting protected data to virtual machines Managing protected machines Understanding replication Managing events Generating and viewing reports Restoring data Understanding bare metal restore for Windows machines Retention and archiving Managing cloud accounts Working with Linux machines Understanding the Local Mount Utility Central Management Console Understanding the Rapid Recovery Command Line Management utility Understanding the Rapid Recovery PowerShell module
Prerequisites for using PowerShell Working with commands and cmdlets Rapid Recovery PowerShell module cmdlets Localization Qualifiers
Extending Rapid Recovery jobs using scripting Rapid Recovery APIs Glossary

Working with encryption keys

This section describes the process of securing data in your environment using encryption keys.


Was this topic helpful?

[Select Rating]



Understanding encryption keys

The Rapid Recovery Core can encrypt snapshot data for all volumes within any repository using encryption keys that you define and manage from the Core Console.

Instead of encrypting the entire repository, Rapid Recovery lets you specify an encryption key for one or more machines protected on a single Rapid Recovery Core. Each active encryption key creates an encryption domain. There is no limit to the number of encryption keys you can create on the Core.

In a multi-tenant environment (when a single Core hosts multiple encryption domains), data is partitioned and deduplicated within each encryption domain. As a result, Dell recommends using a single encryption key for multiple protected machines if you want to maximize the benefits of deduplication among a set of protected machines.

You can also share encryption keys between Cores using one of three methods. One method is to export an encryption key as a file from one Rapid Recovery Core and import it to another Core. A second method is to archive data secured with an encryption key, and then import that archived data into another Rapid Recovery Core. The third method is to replicate recovery points from a protected machine using an encryption key. After you replicate protected machines, the encryption keys used in the source Core appear as replicated encryption keys in the target Core.

In all cases, once imported, any encryption key appears in the Core with a state of Locked. To access data from a locked encryption key, you must unlock it. For information about importing, exporting, locking or unlocking encryption keys, see the topic Managing encryption keys.

Key security concepts and considerations include:

  • Encryption is performed using 256 Bit Advanced Encryption Standard (AES) in Cipher Block Chaining (CBC) mode that is compliant with SHA-3.
  • Deduplication operates within an encryption domain to ensure privacy.
  • Encryption is performed without impact on performance.
  • You can apply a single encryption key to any number of protected machines, but any protected machine can only have one encryption key applied at a time.
  • You can add, remove, import, export, modify, and delete encryption keys that are configured on the Rapid Recovery Core.
    CAUTION:
    Rapid Recovery takes a new snapshot whenever you apply an encryption key to a protected machine. A new snapshot is also triggered after you disassociate an encryption key for a protected machine.

Encryption keys generated from the Rapid Recovery Core are text files that contain four parameters, as described in the following table:

Table 1. Components of an encryption key
Component Description
Name This value is equivalent to the key name given when adding a key in the Rapid Recovery Core Console.
Key This parameter consists of 107 randomly generated English alphabetic, numeric, and mathematical operator characters.
ID The key ID consists of 26 randomly generated upper-case and lower-case English characters.
Comment The comment contains the text of the key description entered when the key was created.

Was this topic helpful?

[Select Rating]



Applying or removing encryption from a protected machine

You can secure the data protected on your Core at any time by defining an encryption key and applying it to one or more protected machines in your repository. You can apply a single encryption key to any number of protected machines, but any protected machine can only use one encryption key at a time.

The scope of deduplication in Rapid Recovery is limited to protected machines using the same repository and encryption key. Therefore, to maximize the value of deduplication, Dell recommends applying a single encryption key to as many protected machines as is practical. However, there is no limit to the number of encryption keys you can create on the Core. Thus, if legal compliance, security rules, privacy policies, or other circumstances require it, you can add and manage any number of encryption keys. You could then apply each key to only one protected machine, or any set of machines in your repository.

Any time you apply an encryption key to a protected machine, or dissociate an encryption key from a protected machine, Rapid Recovery takes a new base image for that machine upon the next scheduled or forced snapshot. The data stored in that base image (and all subsequent incremental snapshots taken while an encryption key is applied) is protected by a 256-bit advanced encryption standard. There are no known methods for compromising this method of encryption.

If you change the name or passphrase for an existing encryption key currently used to a protected machine, then upon the next scheduled or forced snapshot, Rapid Recovery Core captures and reflects the updated properties of the key. The data stored in that image (and all subsequent incremental snapshots taken while an encryption key is applied) is protected by a 256-bit advanced encryption standard. There are no known methods for compromising this method of encryption.

Once an encryption key is created and applied to a protected machine, there are two concepts involved in removing that encryption. The first is to disassociate the key from the protected machine. Optionally, once the encryption key is disassociated from all protected machines, it can be deleted from the Rapid Recovery Core.

This section includes the following topics:


Was this topic helpful?

[Select Rating]



Associating an encryption key with a protected machine

You can apply an encryption key to a protected machine using either of two methods:

  • As part of protecting a machine. When using this method, you can apply encryption to one or multiple machines simultaneously. This method lets you add a new encryption key, or apply an existing key to the selected machine or machines.

    To use encryption when first defining protection for a machine, you must select the advanced options in the relevant Protect Machines Wizard. This selection adds an Encryption page to the wizard workflow. From this page, select Enable encryption, and then select an existing encryption key or specify parameters for a new key. For more information, see Protecting a machine or About protecting multiple machines, respectively.

  • By modifying the configuration settings for a machine. This method applies an encryption key to one protected machine at a time. There are two approaches for modifying configuration settings for a machine in the Rapid Recovery UI:
    • Modify the configuration settings for a specific protected machine. The encryption key you want to use for this approach must already exist on the Rapid Recovery Core, be a universal key type, and must be in an unlocked state. Encryption is part of the General settings. For more information, see Viewing and modifying protected machine settings.
    • Click the [Not Encrypted] Not Encrypted icon on the Protected Machines page. Using this approach you can create and apply a new encryption key, or assign an existing unlocked universal key to the specified protected machine. For more information, see Applying an encryption key from the Machines page.

Was this topic helpful?

[Select Rating]



Related Documents