Data encryption is more important than ever for companies to protect their business-critical and sensitive data, both in transit and at-rest. As this data continually grows, it is critical for encryption methods to keep pace. From a systems performance point of view, encryption is a calculation-intensive operation that when performed in software, consumes CPU cycles that could have been used for applications. This can lead to overall application performance degradation due to the application not having as many CPU resources to work with. The KIOXIA Innovation Lab set out to find solutions that protect data through encryption without experiencing performance degradation or unnecessary CPU usage.
One solution is to use KIOXIA Self-encrypting Drives1 (SEDs) to offload the encryption task from the server CPU to these drives. These SED SSDs support the TCG-Opal2 specification and implement on-board crypto-processors which use an AES3-256 cryptographic module and media encryption key to encrypt plain-text data. The self-encrypting capabilities ensure that data-at-rest is encrypted at the hardware layer to prevent unauthorized access. To test and see if this solution would not impact application performance, the KIOXIA Innovation Lab conducted database throughput tests using a Microsoft® SQL Server™ database hosted on top of four 3.84 terabyte4 (TB) KIOXIA CD8P-R Series data center NVMe SSDs, with no encryption and encryption enabled. An HPE ProLiant DL360 Gen11 server was used. The configuration set-up, test procedures and test results are available here.
The tests results showed that the HPE ProLiant DL360 Gen11 server and KIOXIA CD8P-R Series SSDs effectively delivered similar database throughput performance of more than 2.4 million transactions per minute (TPM), whether encryption was present or not. CPU utilization was also similar, with or without, which validated that the CPU resources (at approximately 78% utilization) were not impacted when encryption was present (see results5 below):
The test results demonstrated that systems and applications that use SED SSDs based on the TCG-Opal standard can utilize the CPU resources for performance and processing tasks, versus encryption-related tasks. The encrypted solution featuring an HPE ProLiant DL360 Gen11 server deployed with KIOXIA CD8P-R Series SSDs did not impact application or system performance, and effectively delivered similar database throughput performance, whether encryption was present or not. CPU utilization was also not impacted when encryption was present.
Based on these tests, the HPE ProLiant DL360 Gen 11 server equipped with KIOXIA CD8P-R Series SSDs delivered encryption protection without a database throughput or CPU usage hit.
KIOXIA CD8P-R Series SSD information available here.
FOOTNOTES:
1 Self-encrypting Drives (SEDs) encrypt all data to SSDs and decrypt all data from SSDs, via an alphanumeric key (or password protection) to prevent data theft. It continuously scrambles and descrambles data written to and retrieved from SSDs.
2 Developed by the Trusted Computing Group® (TCG), a not-for-profit international standards organization, the Opal specification is used for applying hardware-based encryption to solid state drives and often referred to as TCG-Opal.
3 The Advanced Encryption Standard (AES) is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology in 2001.
4 Definition of capacity – Kioxia Corporation defines a megabyte (MB) as 1,000,000 bytes, a gigabyte (GB) as 1,000,000,000 bytes and a terabyte (TB) as 1,000,000,000,000 bytes. A computer operating system, however, reports storage capacity using powers of 2 for the definition of 1Gbit = 230 bits = 1,073,741,824 bits, 1GB = 230 bytes = 1,073,741,824 bytes and 1TB = 240 bytes = 1,099,511,627,776 bytes and therefore shows less storage capacity. Available storage capacity (including examples of various media files) will vary based on file size, formatting, settings, software and operating system, and/or pre-installed software applications, or media content. Actual formatted capacity may vary.
5 Read and write speed may vary depending on the host device, read and write conditions, and file size.
TRADEMARKS:
HPE and ProLiant are registered trademarks of Hewlett-Packard Enterprise Company and/or its affiliates. Microsoft and SQL Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. NVMe is a registered or unregistered trademark of NVM Express, Inc. in the United States and other countries. PCIe is a registered trademark of PCI-SIG. Trusted Computing Group is a registered trademark of Trusted Computing Group. All other company names, product names and service names may be trademarks of third-party companies.
DISCLAIMERS:
KIOXIA America, Inc. may make changes to specifications and product descriptions at any time. The information presented in this blog is for informational purposes only and may contain technical inaccuracies, omissions and typographical errors. Any performance tests and ratings are measured using systems that reflect the approximate performance of KIOXIA America, Inc. products as measured by those tests. In no event will KIOXIA America, Inc. be liable to any person for any direct, indirect, special or other consequential damages arising from the use of any information contained herein, even if KIOXIA America, Inc. are advised of the possibility of such damages.