You Don’t Have to Trade Performance for Encryption

System Tested: KIOXIA CM7 Series SSD / Dell™ PowerEdge™ R6615 Server

Everyone that has access to a data center is responsible for the security of the data stored there.  Encryption methods are necessary whether the data is moving across a network (data-in-transit) or residing in storage (data-at-rest). Encryption methods at the network layer are used to protect data-in-transit and these methods have typically been successful. On the contrary, data-at-rest is often not encrypted due to the resource constraints associated with encryption or decryption processes. The way to protect data-at-rest is to utilize an encryption key which allows access to storage and protects the data, in the case that a drive is removed from the system. The data in the file system or drive is stored in an unreadable format that is only accessible if the encryption key is provided. 

A common belief is that protecting data-at-rest through encryption can slow a system down and reduce the performance of the storage devices. Software and system-level encryption and decryption processes can consume system resources, increasing storage latency and degrading application performance. To avoid this performance reduction, encryption can happen at the SSD level instead. This hardware-level encryption, such as the KIOXIA Self-Encrypting Drive¹ (SED) option² does not consume host CPU resources to encrypt data and does not suffer from the same performance degradation issues. 

The KIOXIA SED option includes an onboard cryptographic processor and uses an AES³-256 cryptographic module to encrypt raw binary data directly at the hardware layer. In other words, the encryption engine is built into each KIOXIA CM7-R Series drive itself.  Enabling the encryption key simply controls access to data and has no performance impact on KIOXIA SSDs with the SED option. In practical terms, it means you can protect data-at-rest without sacrificing the high-speed performance you expect from enterprise PCIe^® 5.0 SSDs. 

The KIOXIA Innovation Lab wanted to demonstrate that enabling the encryption key does not lead to degraded drive performance. All KIOXIA SSDs with an SED option have encryption built directly into the drives.  Passing the key unlocks the drive and enables data to flow through the encryption processor whether the encryption key is enabled or not.  We configured a test system that included a Dell™ PowerEdge™ R6615 server with one 3.84 terabyte⁴ (TB) KIOXIA CM7-R Series SSD with the SED option. 

We tested drive performance⁵ with encryption enabled and disabled based on five common workloads: 

• 100% sequential read
• 100% sequential write
• 100% random read
• 100% random write
• Mixed random read/write 

The test metrics included: 

• Input/output operations per second (IOPS)
• Throughput
• Read/write latency
   

NOTE: Each metric was run three times for 5 minutes, and the average result was recorded. 

The KIOXIA SSDs delivered as expected as the Dell PowerEdge R6615 server / KIOXIA CM7-R Series SSD system delivered similar IOPS and throughput (see images below), as well as latency, whether the encryption key was enabled or not.

Enabling encryption did not reduce drive performance because encryption is native to the KIOXIA CM7-R Series SSD architecture. Therefore, activating the encryption key does not create additional overhead. 

Bottom Line

If you’ve been holding back on enabling data-at-rest encryption because you feared a performance hit, this Dell PowerEdge R6615 server paired with a KIOXIA CM7-R Series SSD with SED option gives you both strong encryption and enterprise-class storage performance.  Since the drive’s hardware-based encryption is always in the data path, enabling the authentication key does not slow it down. That means you can improve security, support compliance efforts and protect sensitive business data without giving up the speed your workloads demand. You do not need to trade performance for encryption. The full report is available here. 

NOTES:

¹ Self-Encrypting Drives (SEDs) encrypt all data to SSDs and decrypt all data from SSDs, via an alphanumeric key (or password protection) to prevent data theft.  It continuously scrambles and descrambles data written to and retrieved from SSDs. 

² Optional security feature compliant drives are not available in all countries due to export and local regulations. 

³ The Advanced Encryption Standard (AES) is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology in 2001. 

Corporation defines a megabyte (MB) as 1,000,000 bytes, a gigabyte (GB) as 1,000,000,000 bytes and a terabyte (TB) as 1,000,000,000,000 bytes. A computer operating system, however, reports storage capacity using powers of 2 for the definition of 1Gbit = 2³⁰ bits = 1,073,741,824 bits, 1GB = 2³⁰ bytes = 1,073,741,824 bytes and 1TB = 2⁴⁰ bytes = 1,099,511,627,776 bytes and therefore shows less storage capacity. Available storage capacity (including examples of various media files) will vary based on file size, formatting, settings, software and operating system, and/or pre-installed software applications, or media content. Actual formatted capacity may vary. 

⁵ Read and write speed may vary depending on the various factors such as host devices, software (drivers, OS, etc.) and read/ write conditions.

TRADEMARKS:

Dell and PowerEdge are trademarks of Dell Inc. or its subsidiaries.  PCIe is a registered trademark of PCI-SIG.  All other company names, product names and service names may be trademarks or registered trademarks of third-party companies.

DISCLAIMERS:

KIOXIA America, Inc. may make changes to specifications and product descriptions at any time.  The information presented in this blog is for informational purposes only and may contain technical inaccuracies, omissions and typographical errors.  Any performance tests and ratings are measured using systems that reflect the approximate performance of KIOXIA America, Inc. products as measured by those tests. In no event will KIOXIA America, Inc. be liable to any person for any direct, indirect, special or other consequential damages arising from the use of any information contained herein, even if KIOXIA America, Inc. are advised of the possibility of such damages.