Encryption Support Evaluation

Consumers looking for encryption capabilities can opt to encrypt a iSCSI share with TrueCrypt or some in-built encryption mechanism in the client OS. However, if requirements dictate that the data must be shared across multiple users / computers, relying on encryption in the NAS is the best way to move forward. Most NAS vendors use the industry-standard 256-bit AES encryption algorithm. One approach is to encrypt only a particular shared folder while the other approach is to encrypt the full volume. Synology supports only folder-level encryption for now in DSM.

On the hardware side, encryption support can be in the form of specialized hardware blocks in the SoC (common in ARM / PowerPC based NAS units). In x86-based systems, accelerated encryption support is dependent on whether the AES-NI instruction is available on the host CPU. One of the most attractive features of the Intel Rangeley platform / Silvermont cores is full hardware acceleration for all essential cryptography functions. The results, as you can see below, are consistent across all evaluated scenarios. The penalty compared to unencrypted shares is non-existent.

HD Video Playback - Encrypted CIFS

2x HD Playback - Encrypted CIFS

4x HD Playback - Encrypted CIFS

HD Video Record - Encrypted CIFS

HD Playback and Record - Encrypted CIFS

Content Creation - Encrypted CIFS

Office Productivity - Encrypted CIFS

File Copy to NAS - Encrypted CIFS

File Copy from NAS - Encrypted CIFS

Dir Copy to NAS - Encrypted CIFS

Dir Copy from NAS - Encrypted CIFS

Photo Album - Encrypted CIFS

robocopy (Write to NAS) - Encrypted CIFS

robocopy (Read from NAS) - Encrypted CIFS

The write performance with encrypted shares could do with some improvement (for certain workload traces). Other than that, the higher clock for the SoC (compared to the Seagate NAS Pro) and the presence of AES-NI in the SoC (compared to its absence in the SoC used in the QNAP TS-451) enable the DS415+ to come out trumps in most of the above benchmarks.

Multi-Client iSCSI Evaluation Miscellaneous Aspects and Final Words
Comments Locked

41 Comments

View All Comments

  • ganeshts - Thursday, October 30, 2014 - link

    Encryption testing is with a single client. The limitation is on the client side which has only a single GbE link.

    Reason it is done this way is to make sure we have data that can be compared against other units that have been evaluated before.
  • thewishy - Friday, October 31, 2014 - link

    Well, the client side isn't entirely the problem here. You could do LACP on the client side too, and still only see gigabit. Ethernet was never designed to receive frames out of order, and the two interfaces aren't easily syncronised - so traffic between a pair of endpoints is sent over only one link. Fine and dandy for busy networks, poor in this scenario
  • Sonic01 - Tuesday, November 4, 2014 - link

    Makes sense, it's a shame you guys don't test this as some of us might be using a client or server configured with link aggregation.

    I've purchased this NAS, a LAG capable switch and network card for my desktop and server, will see what kind of performance I get...
  • xenol - Thursday, October 30, 2014 - link

    Gallery: Gallery Title!

    I laughed harder than I should at that.
  • shelbystripes - Thursday, October 30, 2014 - link

    Two questions I can't find the answers for anywhere:

    1) Does the 415+ come with ECC RAM?

    2) If not, does it work if you put ECC RAM in it?

    One of the key potential benefits of Avoton/Rangeley is support for ECC RAM, but Synology doesn't mention it, and it seems like the kind of thing you'd advertise (or at least list in the specifications) if you used it.
  • ganeshts - Thursday, October 30, 2014 - link

    Nope, no ECC RAM. The platform may support it, but Synology's board doesn't. At this price point, ECC support is difficult to get.
  • shelbystripes - Thursday, October 30, 2014 - link

    ganeshts: I don't understand this. I'm not saying I don't understand you, or don't believe you. (If I didn't think your answer was possible, I wouldn't have asked the question.) What I am saying is, I don't understand why ECC RAM isn't supported in this model.

    From the block diagram under "Platform Analysis", it appears that the memory controller is built into the CPU/SoC, and the C2538 they're using does support ECC RAM. DDR3 SODIMMs are 204-pin whether they're ECC or not, and while it's not really discussed in this review, a teardown on legionhardware.com shows the memory as a single SODIMM module. Since Synology is using an SoC with an integrated ECC-capable memory controller, I can't understand why they would leave out ECC memory support. It seems like it would have to be an active choice on their part not to, in order to discourage people from sticking in ECC RAM on their own. (Synology doesn't like its users upgrading RAM and claims that doing so will void the warranty, which is something the PC industry stopped pulling a decade ago.) All the necessary hardware should be there, right? So why doesn't it work if you just stuck an ECC UDIMM in there? Did Synology actively disable this feature of the SoC?
  • chubbypanda - Thursday, October 30, 2014 - link

    While dimensions and sockets for DDR3 and ECC DDR3 modules are physically the same, they've got different electrical layouts! Inserting regular memory module into ECC DDR3 equipped board would result in damaged memory module and possibly the board.

    As why Synology chose not to use ECC memory (despite they could have), Ganesh already answered that.
  • jabber - Friday, October 31, 2014 - link

    Plus it leaves them open to sell a version in the future that does support ECC and charge you an extra $400 for the benefit.
  • shelbystripes - Friday, October 31, 2014 - link

    Chubbypanda: Thanks for your reaponse, it put me on the right track.

    I was about to say that I don't buy this, since both ASUS and SuperMicro make Avoton boards that are listed as taking both ECC and non-ECC RAM. But on a closer look, only the SuperMicro mATX boards (which have full-size 240-pin DIMM sockets) claim to support both ECC and non-ECC RAM. Their mini-ITX boards (which have 204-pin SODIMM sockets) support ECC RAM only. The missing pins in SODIMMs must be ones that would allow cross-compatibility (probably by providing separate electrical signals for ECC and non-ECC RAM, at least for detection at startup).

    I think that's it. Since the Synology unit uses SODIMMs, it can only support one or the other, and they chose non-ECC. Boo. If (as jabber mentioned) they release a higher-end version with ECC RAM, I'll buy it... If I haven't given up waiting for it and built myself a FreeNAS box. I had been waiting and hoping for the inevitable Avoton Synology box, but I hadn't anticipated this.

Log in

Don't have an account? Sign up now