Administrator Guide

Support for SED drives on PERC (OpenManage Secure Enterprise Key Management)

PERC 10 FW 50.5.1-2633 added support for enterprise key management. Secure enterprise key management mode

has the same support for drives as LKM and secured Virtual Disks are also managed the same way as in LKM. The

major difference between LKM and secure enterprise key management behavior is that the key used to unlock the

drives is stored on an external server instead of the local controller. This enables PERC to protect the drives data

from theft of an entire system. During boot, PERC will request a key from IDRAC. IDRAC will then communicate with

the key management server and provide the key to the PERC. When a drive locked with secure enterprise key

management is inserted during run time, the PERC will again request and wait for a key from IDRAC to unlock the

drive. Please see latest PERC and IDRAC user guides for more details on the OpenManage Secure Enterprise Key

Management.

PERC Security Management Applications

The PERC LKM controller passphrase can be managed from:

• HII

• PERCcli

• Open Manage

• IDRAC

The PERC enterprise key management controller passphrase can be managed from:

• IDRAC

NOTE: Enterprise key management mode must be managed from IDRAC. HII, PERCcli, & Open Manage only

allow the user to disable the security mode if no secured Virtual Disks are present.

Threat Models Covered by PERC

PERC LKM protects against theft of drives. If an entire system is stolen, the key that is used to unlock the drive is still

stored on the PERC controller allowing the drives to be unlocked at next boot.

PERC enterprise key management protects both theft of drives and theft of entire servers. If an entire system is

stolen the key required to unlock the drives is located on a different physical server and the data will not be

accessible until IDRAC is able to communicate with the key server and unlock the drives. Please see latest PERC

and IDRAC user guides for more details.

Supported Security Protocol

PERC supports TCG Enterprise SSC for enabling secured encryption on SED Drives. See

trustedcomputinggroup.org for more information. DELL’s Enterprise drives that support SED follow this standard.

PERC 10 SED Support with Non-RAID disks

PERC 10 FW 50.5.0-1750 added support for eHBA mode allowing RAID and Non-RAID disks in the system. Under

eHBA mode, both VDs and Non-RAID disks can be secured. See the latest PERC 10 User Guide for more

information about eHBA mode and securing Non-RAID disks.