Dell EMC
Unity/Unity XT 12 Gb/s SAS I/O Module with
Encryption
FIPS 140-2 Non-Proprietary Security Policy
Revision 2.1
October 2020
Storage Processor SAS Module:
FW: 03.90 or 04.10 and P/N 362-000-332, P/N 363-000-071, P/N 363-000-084 and P/N 364-000-096
Embedded SAS Module:
FW: 04.10 and P/N 362-000-333, P/N 363-000-071, P/N 363-000-084 and P/N 364-000-096
Pluggable I/O SAS Module:
FW 03.90 or 04.10 and P/N 362-000-333, P/N 363-000-071, P/N 363-000-084 and P/N 364-000-063
Revisions
2 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security Policy
Revisions
Rev. Date Description
1.8 May 2017 Initial release – Prepared by Corsec Security Inc. on behalf of
EMC corporation
2.0 November 2019 Update for revalidation by Dell EMC
2.1 October 2020 Update for revalidation by Dell EMC
The information in this publication is provided “as is.” Dell Inc. makes no representations or warranties of any kind with respect to the
information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose.
Use, copying, and distribution of any software described in this publication requires an applicable software license.
Copyright © 2020 Dell Inc. or its subsidiaries. All Rights Reserved. Dell, EMC, Dell EMC and other trademarks are trademarks of Dell
Inc. or its subsidiaries. Other trademarks may be trademarks of their respective owners. This document may be freely reproduced and
distributed whole and intact including this copyright notice.
10/20/2020 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security Policy, Rev. 2.1
Table of contents
3 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security Policy
Contents
Revisions.........................................................................................................................................2
Contents..........................................................................................................................................3
Figures ............................................................................................................................................4
Tables .............................................................................................................................................4
1 Introduction............................................................................................................................5
1.1 Purpose .......................................................................................................................5
1.2 References ..................................................................................................................5
2 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption.....................................6
2.1 Overview......................................................................................................................6
2.2 Module Specification ...................................................................................................7
2.3 Module Interfaces........................................................................................................9
2.4 Roles and Services....................................................................................................10
2.5 Physical Security .......................................................................................................11
2.6 Operational Environment...........................................................................................13
2.7 Cryptographic Key Management...............................................................................13
2.8 EMI/EMC ...................................................................................................................14
2.9 Self-Tests ..................................................................................................................14
2.9.1 Power-Up Self-Tests........................................................................................15
2.9.2 Conditional Self-Tests......................................................................................15
2.9.3 Critical Functions Self-Tests............................................................................15
2.10 Mitigation of Other Attacks ........................................................................................16
3 Secure Operation ................................................................................................................17
3.1 Initial Setup................................................................................................................17
3.2 Secure Management .................................................................................................18
3.2.1 Management....................................................................................................18
3.2.2 Monitoring Status.............................................................................................18
3.2.3 Zeroization .......................................................................................................18
3.3 User Guidance...........................................................................................................18
3.4 Non-FIPS Approved Mode ........................................................................................18
4 Acronyms ............................................................................................................................19
Appendix A - Technical Support and Resources ..........................................................................21
Table of contents
4 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security Policy
Figures
Figure 1 - Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption Block Diagram.......8
Figure 2 - Top view of Pluggable I/O SAS Module ........................................................................12
Figure 3 - Bottom view of Pluggable I/O SAS Module...................................................................12
Figure 4 - Top view of Storage Processor SAS module ................................................................12
Figure 5 - Top view of Embedded SAS module............................................................................13
Figure 6 - Bottom view of Embedded SAS module .......................................................................13
Tables
Table 1 - Security Level per FIPS 140-2 Sections...........................................................................7
Table 2 - FIPS-Approved algorithm implementations ......................................................................9
Table 3 - FIPS 140-2 Logical Interface Mappings .........................................................................10
Table 4 - Crypto Officer and User Services ...................................................................................11
Table 5 - List of Cryptographic Keys, Cryptographic Key Components, and CSPs ......................14
Table 6 - Acronyms........................................................................................................................19
Introduction
5 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security Policy
1 Introduction
1.1 Purpose
This is a non-proprietary Cryptographic Module Security Policy for the Dell EMC Unity/Unity XT 12
Gb/s SAS I/O Module with Encryption. This Security Policy describes how the Dell EMC Unity/Unity
XT 12 Gb/s SAS I/O Module with Encryption meets the security requirements of Federal Information
Processing Standards (FIPS) Publication 140-2. For additional information please visit
Cryptographic Module Validation Program (CMVP) website at
https://csrc.nist.gov/projects/cryptographic-module-validation-program.
This document also describes how to operate the module in a secure FIPS-approved mode of
operation. This policy was prepared as part of the Level 1 FIPS 140-2 validation of the module. The
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption is also referred to in this
document as the module.
1.2 References
This document deals only with operations and capabilities of the module in the technical terms of a
FIPS 140-2 cryptographic module security policy. More information is available on the module from
the following sources:
• The Dell EMC website (www.dellemc.com) contains information on the full line of products from
Dell EMC.
• The CMVP website (https://csrc.nist.gov/projects/cryptographic-module-validation-
program/validated-modules/search) contains contact information for individuals to answer
technical or sales-related questions for the module.
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
6 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
2 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O
Module with Encryption
2.1 Overview
The Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption is a high-density SAS
controller chipset executing specialized firmware that provides Data At Rest Encryption
(D@RE) for Dell EMC Unity/Unity XT storage arrays. D@RE provides data security and offers
a convenient means to decommission all drives in the system at once. Information is protected
from unauthorized access even when drives are physically removed from the system. The Dell
EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption is an optimized solution for
native SAS HBA applications.
The Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption implements 256-bit
AES-XTS encryption/decryption to encrypt and decrypt data as it is being written to or read
from a SAS drive. The module is available in five (5) variants.
The Storage Processor SAS Module variant is embedded on the printed circuit board (PCB) of
the Storage Processor (SP). The Storage Processor SAS module consists of:
• FW: 03.90 or 04.10
• SAS Controller (P/N 362-000-332)
• Flash Memory (P/N 363-000-071)
• Serial EEPROM (P/N 363-000-084)
• 75 MHz Clock (P/N 364-000-096)
The Embedded SAS Module variant is embedded on the SP assembly’s embedded module
component. The Embedded SAS Module variant consists of:
• FW: 04.10
• SAS Controller (P/N 362-000-333)
• Flash Memory (P/N 363-000-071)
• Serial EEPROM (P/N 363-000-084)
• 75 MHz Clock (P/N 364-000-096)
The Pluggable I/O SAS Module variant is embedded on the PCB of a pluggable I/O Module.
The Pluggable I/O SAS Module consists of:
• FW: 03.90 or 04.10
• SAS Controller (P/N 362-000-333)
• Flash Memory (P/N 363-000-071)
• Serial EEPROM (P/N 363-000-084)
• 75 MHz Clock (P/N 364-000-063)
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
7 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
The Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption is validated at the
FIPS 140-2 Section levels shown in Table 1 below.
Table 1 - Security Level per FIPS 140-2 Sections
Section Section Title Level
1 Cryptographic Module Specification 1
2 Cryptographic Module Ports and Interfaces 1
3 Roles, Services, and Authentication 1
4 Finite State Model 1
5 Physical Security 1
6 Operational Environment N/A
7 Cryptographic Key Management 1
8 EMI/EMC 1
9 Self-tests 1
10 Design Assurance 1
11 Mitigation of Other Attacks N/A
2.2 Module Specification
The Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption is a hardware module
with a multiple-chip embedded embodiment. The overall security level of the module is 1
(one).
The cryptographic boundary of the Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with
Encryption includes the following components:
 SAS controller:
- P/N 362-000-332 eight-lane SAS controller that is configured to provide two quad-
lane SAS interfaces. It incorporates FIPS 197 validated, IEEE 1619-compliant
XTS-AES encryption engines.
- P/N 362-000-333 sixteen-lane SAS controller that can be configured to provide four
quad-lane SAS interfaces or two eight-lane SAS interfaces. It incorporates FIPS
197 validated, IEEE 1619-compliant XTS-AES encryption engines.
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
8 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
 Flash Memory (P/N 363-000-071)
 Serial EEPROM (P/N 363-000-084)
 75 MHz reference clock:
- Within Storage Processor SAS Module and Embedded SAS module – P/N 364-
000-096
- Within Pluggable I/O SAS Module – P/N 364-000-063
The cryptographic module includes 16MB of Flash memory for firmware storage and error
logging and 4KB SEEPROM for boot block, errata storage, and initialization of the module.
The module also includes an on-board 75 MHz reference clock. The module uses SAS ports
to interface with the attached storage and PCIe to interface with the host device. Figure 1
below presents the block diagram of the module.
KEY:
PCIe – Peripheral Component Interconnect express
SEEPROM – Serial Electrically Erasable Programmable Read Only Memory
SAS – Serial Attached SCSI (Small Computer System Interface)
SAS
Ports
PCIe
Interface
Reference
Clock
SAS Controller
Flash
Memory
SEEPROM
Plaintext Data
Encrypted Data
Control Input
Status Output
Power Supply
Crypto Boundary
Figure 1 - Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption Block Diagram
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
9 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
The module implements the FIPS-approved algorithms listed in Table 2 below.
Table 2 - FIPS-Approved algorithm implementations
Algorithm
Certificate
Number
256-bit AES ECB encryption/decryption 3586
256-bit AES-XTS encryption/decryption.
In compliance with IG A.9, the module performs the check of Key 1 ≠ Key 2 prior
to using keys for AES-XTS encryption/decryption.
3598
256-bit AES Key Wrap
The module provides key wrap and unwrap functions. Only the AES key unwrap
function is currently used.
3598
HMAC with SHA-512
The module uses HMAC SHA-512 only to perform the integrity test during power-
up. The HMAC and SHA algorithms are not available once the module is
operational. HMAC SHA-1, HMAC SHA-224, HMAC SHA-256 and HMAC SHA-
384 listed on certificate #2296 are not accessible.
2296
SHA-512
SHA-1, SHA-224, SHA-256 and SHA-384 listed on certificate #2961 are not
accessible.
2961
2.3 Module Interfaces
The module’s design separates the physical connections into four logically distinct and
isolated categories. They are:
 Data Input Interface
 Data Output Interface
 Control Input Interface
 Status Output Interface
In addition, the module supports a Power Input interface.
Physical interfaces for the Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
are described in Table 3 below.
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
10 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
Table 3 - FIPS 140-2 Logical Interface Mappings
Physical Port/Interface Quantity FIPS 140-2 Interface
PCIe interface Storage Processor SAS
Module: 1
Embedded SAS Module: 1
Pluggable I/O SAS Module: 1
Data Input
Data Output
Control Input
Status Output
Power Input
SAS interface Storage Processor SAS
Module: 2 x 4 (8 x 12G ) ports
Embedded SAS Module: 4 x 4
(16 x 12G ) ports or 2 x 8 (16 x
12G) ports
Pluggable I/O SAS Module: 4
x 4 (16 x 12G ) ports or 2 x 8
(16 x 12G) ports
Data Input
Data Output
2.4 Roles and Services
There are two roles in the module that operators may assume: a Crypto Officer (CO) role and
a User role. Roles are assumed implicitly based on the service accessed.
Descriptions of the services available to a CO and a User are described below in Table 4.
Please note that the keys and Critical Security Parameters (CSPs) listed in the Table 4
indicate the type of access required using the following notation:
R – Read: The CSP is read.
W – Write: The CSP is established, generated, modified, or zeroized.
X – Execute: The CSP is used within an Approved or Allowed security function or
authentication mechanism.
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
11 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
Table 4 - Crypto Officer and User Services
2.5 Physical Security
The Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption is a multiple-chip
embedded cryptographic module. The module consists of production-grade components that
include standard passivation techniques. Figure 2 and Figure 3 below identify all components
within the cryptographic boundary along with module interfaces of the Pluggable I/O SAS
Module. Figure 4 identifies all components within the cryptographic boundary along with
module interfaces of the Storage Processor SAS Module. Figure 5 and Figure 6 identify all
components within the cryptographic boundary along with module interfaces of the Embedded
SAS Module.
Service CO User Description Input Output
CSP and Type
of Access
Configure
parameters
✓ -
Configuring the module’s
configuration parameters
Command Status output None
Show Status - ✓ Show the module’s status Command Status output None
Load KEK ✓ - Load KEK Command Status output
KEK - W
KEK-KEK - R/X
Zeroize KEK ✓ -
Zeroize KEK
Zeroize KEK-KEK
Command Status output
KEK - W
KEK-KEK - W
Load DEK ✓ - Load DEK Command Status output
DEK - W
KEK - R/X
Zeroize DEK ✓ - Zeroize DEK Command Status output DEK - W
Encryption/
Decryption I/Os
- ✓
Perform encryption/decryption
of I/Os over SAS interface
Command Status output DEK - R/X
Power down ✓ -
Power down the module. KEK
and DEK are zeroized as part
of the power down process.
Command Status output
KEK - W
DEK - W
Perform self-
tests
✓
-
Invoke self-tests via a reboot or
power cycling
Rebootor
power
cycling
Status output None
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
12 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
Figure 2 - Top view of Pluggable I/O SAS Module
Figure 3 - Bottom view of Pluggable I/O SAS Module
Figure 4 - Top view of Storage Processor SAS module
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
13 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
2.6 Operational Environment
The cryptographic module employs a non-modifiable operating environment. The
cryptographic module does not provide a general-purpose Operating System (OS) to the
operator. The operational environment of the cryptographic module consists of the module’s
firmware v03.90 or v04.10. The module only loads and executes firmware that successfully
passes the HMAC SHA-512 verification method
2.7 Cryptographic Key Management
The module supports the CSPs listed below in Table 5 below.
Figure 5 - Top view of Embedded SAS module
Figure 6 - Bottom view of Embedded SAS module
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
14 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
Table 5 - List of Cryptographic Keys, Cryptographic Key Components, and CSPs
The KEK-KEK is generated outside the module and automatically loaded into the module in
plaintext form during initial configuration of the module into the approved mode. Configuring
the module for FIPS-approved mode is detailed in Section 3.
The KEK is wrapped outside the module boundary on the host platform with the KEK-KEK.
The KEK is entered encrypted electronically from the host platform of the module. The module
uses its internally stored copy of the KEK-KEK to decrypt (unwrap) the KEK using an AES
(Cert. #3598) key unwrapping algorithm.
The DEK is wrapped outside the module boundary on the host platform with the KEK. The
DEK is entered encrypted electronically from the host platform of the module. The module
then uses the KEK which was previously unwrapped to decrypt (unwrap) the DEK using an
AES (Cert. #3598) key unwrapping algorithm.
2.8 EMI/EMC
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption was tested and found
conformant to the EMI/EMC requirements specified by 47 Code of Federal Regulations, Part
15, Subpart B, Unintentional Radiators, Digital Devices, Class A (business use).
2.9 Self-Tests
Cryptographic self-tests are performed by the module when the module is first powered up.
These power-up self- tests can be initiated on-demand at any time by rebooting or power
cycling the module. The following sections list self-tests performed by the module, their
expected error status, and error resolutions.
CSP CSP Type Generation / Input Output Storage Zeroization Use
DEK 256-bit AES-
XTS
Entered electronically
in ciphertext
Never exits
the module
Stored in
plaintext
within the
SAS
controller
Zeroize DEK
service and
Power down
service
Encryption and
Decryption of data
KEK 256-bit AES
ECB Unwrap
Key
Entered electronically
in ciphertext
Never exits
the module
Stored in
plaintext
within the
SAS
controller
Zeroize KEK
service and
Power down
service
Decryption of DEK
KEK-
KEK
256-bit AES
ECB Unwrap
Key
Loaded electronically
in plaintext as part of
module initial
configuration.
Never exits
the module
Stored in
plaintext
in flash
memory
Zeroize KEK
service
Decryption of KEK
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
15 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
2.9.1 Power-Up Self-Tests
During power-up, once the module is initialized, Dell EMC Unity/Unity XT 12 Gb/s SAS I/O
Module with Encryption performs the following power-on self-tests:
 Main module firmware integrity test – HMAC SHA-512
 Known Answer Tests (KATs)
o AES-ECB encrypt KAT
o AES-ECB decrypt KAT
o AES-XTS encrypt KAT
o AES-XTS decrypt KAT
o AES key unwrap KAT
After powering–on the module, the power-up self-tests will execute automatically with no
intervention from the operator. While the module is executing the self-tests all data output
interfaces are inhibited. When the power- up self-tests complete successfully, then the module
is in a fully operational state. If the module fails an integrity test on main firmware, or any
power-up self-test, then a critical error occurs. The error is logged in a register internally and
outputted from the module over the PCIe interface. Once the module has entered the critical
error state, all cryptographic processing and data output is inhibited.
To clear the critical error state, the module must be power cycled or rebooted. If the condition
persists, the module must be serviced by Dell EMC.
2.9.2 Conditional Self-Tests
The module does not perform any conditional self-tests.
2.9.3 Critical Functions Self-Tests
The Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption performs the following
critical functional self-tests at power-on or reboot of the module:
 ILA integrity test – HMAC SHA-512
While the module is executing the self-tests all data output interfaces are inhibited. When the
critical functions self-tests complete successfully, then the module is in a fully operational
state. If the module fails either of the critical functions tests, then the module enters a critical
error state. The error is logged in a register internally and output from the module over the
PCIe interface. Once the module has entered the critical error state, all cryptographic
processing and data output is inhibited.
To clear the critical error state, the module must be power cycled or rebooted. If the condition
persists, the module must be serviced by Dell EMC.
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
16 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
Note: HMAC SHA-512 is used by the module only to perform the main firmware integrity test and ILA
integrity test. These functions are not available for any other use. The module's integrity check using
HMAC-SHA-512 also serves as the known answer test for the HMAC algorithm.
2.10 Mitigation of Other Attacks
This section is not applicable. The module does not claim to mitigate any attacks beyond the
FIPS 140-2 Level 1 requirements for this validation.
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
17 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
3 Secure Operation
The Del EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption meets Level 1
requirements for FIPS 140-2. The sections below describe how to place the module in the
FIPS-approved mode of operation.
3.1 Initial Setup
The module is available pre-installed on a Dell EMC Unity/Unity XT array. The module is
delivered in a non-operational factory state. The CO is responsible for initialization,
configuration, and management activities of the module.
The module can be managed through the following underlying host device’s interfaces:
• Unisphere Command Line Interface (CLI)
• Unisphere Graphical User Interface (GUI)
The commands and buttons used in these interfaces translate to commands that enter the
module over the PCIe bus.
During initial setup, the CO must perform the following steps to configure the module:
• The CO shall validate the module firmware version number 03.90 or 04.10 by
executing the following service command: svc_diag --state spinfo. For more
information, please refer to the Dell EMC Unity Family Service Commands Technical
Notes document.
• The CO shall install the Unity license file that includes the Data at Rest Encryption
feature on the host device. This process will configure the KEK-KEK. For more
information, please refer to the Dell EMC Unity Family Security Configuration Guide
and Dell EMC Unity: Data at Rest Encryption White Paper.
• The CO shall verify that the Encryption mode has changed from “Unencrypted” to
“Controller Based Encryption” via Unisphere GUI or Unisphere CLI. To view the status
via Unisphere GUI, navigate to Settings > Management > Encryption. To view the
status via Unisphere CLI, use /prot/encrypt show - detail command and for
more information please refer to the Dell EMC Unity Family Unisphere CLI User Guide.
• The CO shall reboot the system. Once the module is powered on and all power-up
self-tests have completed successfully, the module is operating in FIPS-Approved
mode.
Once all steps are completed, the module is initialized.
Note: Dell EMC Unity Family documentation is available via Dell EMC Support. Please reference
Appendix A - Technical Support and Resources for additional information.
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
18 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
3.2 Secure Management
The CO is responsible for ensuring that the module is operating correctly.
3.2.1 Management
When configured according to the guidance stated in this Security Policy, the module runs in a
FIPS-Approved mode of operation. The CO shall manage the module via the host device
interfaces, Unisphere CLI and Unisphere GUI.
3.2.2 Monitoring Status
The CO should monitor the module status regularly. The CO can verify that the module is
operating in the approved mode by ensuring that the Encryption mode reports “Controller
Based Encryption”. Please refer to Section 3.1 for the details to verify the Encryption mode.
When configured according to the guidance stated in this Security Policy, the module operates
in the FIPS-Approved mode. The module when operational is always in the FIPS-Approved
mode.
The current status of the module which is output over the PCIe interface can be monitored via
the Unisphere CLI and Unisphere GUI interfaces. The encryption mode of the array is also
reported on the Unisphere CLI and Unisphere GUI host device interfaces.
Detailed instructions to monitor and troubleshoot the systems are provided via Dell EMC
Support at www.dellemc.com
3.2.3 Zeroization
A CO can perform the Zeroize DEK service or Power down service to zeroize the DEK. The
KEK is zeroized when a CO performs the Zeroize KEK service or Power down service. CO
zeroizes the KEK-KEK by performing the Zeroize KEK service. Once keys are zeroized they
are no longer available to the module.
3.3 User Guidance
No additional guidance for Users is required to maintain the FIPS-Approved mode of
operation.
3.4 Non-FIPS Approved Mode
When initialized and configured according to the instructions in this Security Policy, the
module does not support a non-FIPS-Approved mode of operation.
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
19 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
4 Acronyms
Table 6 below provides definitions for the acronyms used in this document.
Table 6 - Acronyms
Acronym Definition
AES Advanced Encryption Standard
CLI Command Line Interface
CMVP Cryptographic Module Validation Program
CO Crypto Officer
CCCS Canadian Centre for Cyber Security
CSP Critical Security Parameter
D@RE Data At Rest Encryption
DEK Data Encryption Key
ECB Electronic Code Book
EEPROM Electrically Erasable Programmable Read Only Encryption
EMC Electromagnetic Compatibility
EMI Electromagnetic Interference
FIPS Federal Information Processing Standard
GUI Graphical User Interface
HBA Host Bus Adapter
HMAC (Keyed) Hash Messaged Authentication Code
ILA Image Loader Agent
I/O Input/Output
IEEE Institute of Electrical and Electronics Engineers
IT Information Technology
KAT Known Answer Test
KEK Key Encryption Key
KEK-KEK Key Encryption Key-Key Encryption Key
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
20 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
Acronym Definition
MA Massachusetts
KB Kilobyte
MB Megabyte
MHz Megahertz
N/A Not Applicable
NIST National Institute of Standards and Technology
OS Operating System
PCB Printed Circuit Board
PCIe Peripheral Component Interconnect Express
SAS Serial Attached SCSI
SCSI Small Computer System Interface
SEEPROM Serial Electrically Erasable Programmable Read Only Encryption
SSP Serial SCSI Protocol
VA Virginia
XEX XOR-Encrypt-XOR
XOR Exclusive Or
XTS XEX-Based Tweaked-Codebook Mode with Ciphertext Stealing
Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption
21 Dell EMC Unity/Unity XT 12 Gb/s SAS I/O Module with Encryption FIPS 140-2 Non-Proprietary Security
Policy
Appendix A - Technical Support and
Resources
Dell.com/support is focused on meeting customer needs with proven services and support.
Storage technical documents and videos provide expertise that helps to ensure customer
success on Dell EMC storage platforms.
Additional configuration and management documentation for the Dell EMC Unity family can be
found here: https://www.dellemc.com/en-us/documentation/unity-family.htm