Encryption Support Evaluation

Consumers looking for encryption capabilities can opt to encrypt a iSCSI share with TrueCrypt or some in-built encryption mechanism in the client OS. However, if requirements dictate that the data must be shared across multiple users / computers, relying on encryption in the NAS is the best way to move forward. Most NAS vendors use the industry-standard 256-bit AES encryption algorithm. One approach is to encrypt only a particular shared folder while the other approach is to encrypt the full volume. Some NAS vendors have support for both approaches in their firmware, but Synology only opts for the former. Details of Synology's encryption key management mechanism and other caveats are available here.

On the hardware side, encryption support can be in the form of specialized hardware blocks in the SoC (common in ARM / PowerPC based NAS units). In x86-based systems, encryption support is dependent on whether the AES-NI instruction is available on the host CPU (not considering units based on the Intel Berryville platform). Unfortunately, the Atom D2700 used in the Synology DS1812+ doesn't support AES-NI. Encryption is done in software and we can expect the impact to be pretty brutal.

We enabled encryption on a CIFS share and repeated our Intel NASPT / robocopy benchmarks on it. The results are presented in the graph below (with the unencrypted volume numbers for comparison purposes).

Synology DS1812+ Encryption Performance - Windows

As expeced, enabling encryption carries a major performance hit. Depending on the type of workload, the penalty varies between 17% and 76%. Berryville-based platforms (with a hardware encryption engine) should improve this aspect, but NAS units based on that are restricted to a maximum of four bays. Unless we get a platform refresh for this market segment (or NAS vendors opt to go in for a AES-NI enabled Core-series part), it looks like performance with encryption enabled will leave consumers unsatisfied.

Multi-Client Performance - CIFS Miscellaneous Factors and Final Words
Comments Locked

93 Comments

View All Comments

  • SirGCal - Monday, June 17, 2013 - link

    OK, while you're pulling your many TB down from whatever backup service over your internet connection, also killing your internet pipe, slowing it down for everyone in the process for likely weeks or months to get the pull unless your one of the few on fiber or FIOS, I'd rather not have to repopulate 24-28TB of data from backup in the first place. Good luck with that. While I do keep a backup, it's far better not to need it.
  • Jeff7181 - Tuesday, June 18, 2013 - link

    Who sad anything about "cloud" backup? Buy additional high capacity drives and only spin them to perform backups.
  • SirGCal - Sunday, June 16, 2013 - link

    UPDATE ON SYNOLOGY:

    We were finally able to get the Subsonic module loaded and working on it properly and it works fine for music... mostly. But it doesn't have the horsepower to transcode bluray content, even just one viewing, on the fly. I don't know if it's memory or CPU or both but even over the local network (which is disgustingly overkill) it just can't do it. Choppy, stutters, etc. where as mine is smooth and uses ~ 10% CPU or less. I wouldn't think it was that hard on the CPU but... We're still trying to get this to work as it is one of the requirements for him to keep/use this box.
  • name99 - Friday, June 14, 2013 - link

    Forgive me if this is a stupid question, but what's the reason for USB and eSATA ports on a box like this? I understand the basic point of a NAS (as a single box where I can dump a buncha drives and have the HW provide some level of RAID) but how do the USB/eSATA ports play into this?

    Is the idea that, after I have filled this thing up with 8 internal drives but I need still more space, I start adding drives via the external ports?
  • SirGCal - Friday, June 14, 2013 - link

    There are ways to extend the array, but honestly it becomes a point where the most reliable way becomes to buy or build another array. Doing it as a server in box, you can do 8/12/16/24 drive configurations... This stand alone is the first 8 box setup I've seen aside from rack servers which obviously are true rigs costing a LOT more.
  • name99 - Friday, June 14, 2013 - link

    You don't need to convince me. I've built my storage around 5-yr old Macs connected to a bunch of 5-yr old drives using Apple RAID and AFP. Maybe not the right solution for everyone, but meets my needs, and basically free.

    But that's not the point. My question remains. For the people who ARE the target for this sort of device, what's the point of the USB/eSATA parts. Our reviewer, for example, wanted USB ports in front of the box. Why? What would he do with them?
  • SirGCal - Friday, June 14, 2013 - link

    Sorry, According to their own site, you can use two of their own Synology DS513s to increase the capacity to 18 drives. However 18 drives even as RAID 6 becomes not so hot. 8-12 drives is about my limit. At 16 I make two RAID groups and then one volume for the virtual array cluster to use the data from. Then you have 4 parity drives but much better drive protection crossed the array instead of just 2 drives of parity. That's another discussion though. They sell bigger boxes though that I think actually do this type of configurations though. I'd have to research it though. But even their reported numbers don't show great performance. Still should be OK for most home use.

    If you want to plug in a single drive and just add it as a shared folder, I think it will do that. I can ask my friend to give it a go if he gets home and see if ya like.
  • name99 - Friday, June 14, 2013 - link

    I think I have a feeling now, from what both you and Ganesh have said.

    Seems a strangely limited market, to have an environment that wants so much storage, but no-one is willing to just use one of the machines around to plug a drive into and have it act as a file server. But, I guess, I'm not the target audience.
  • SirGCal - Saturday, June 15, 2013 - link

    Ya, that's the catch. For what it is, it's not bad. But the biggest problem in my eyes is that's all it is. It can't do the "other" things that a server could do such as run the other software packages that my servers do... Or at least we haven't figured out how to make it do so yet. We've been beating the pants off my friends rig trying to make it run something like Subsonic which is a media streaming service to stream your own media files to your self when your offsite. Music and videos... I love it and he was hoping to use it also but isn't getting his Synology box to run anything this complicated yet. In some ways I'm actually a bit surprised since it's just a java daemon. (in windows it's a service). I thought of all my software tools, this one might actually work. And there might be a way, we haven't tried hard yet. Or the other fear is the actual CPU won't be capable of trans-coding on the fly... at least videos. We're pretty sure the software will install, but the Atom's are pretty weak. We'll see.. Worst case I guess, we setup yet another server to feed off it for the streaming. Sort-of defeats the purpose but... If it can't do it...
  • Micke O - Monday, June 17, 2013 - link

    The drives in each DS513 must be it's own volume. No BIG volume with all the drives in the main unit and the expansion units is possible.

Log in

Don't have an account? Sign up now