Encryption Support Evaluation

Consumers looking for encryption capabilities can opt to encrypt a iSCSI share with TrueCrypt or some in-built encryption mechanism in the client OS. However, if requirements dictate that the data must be shared across multiple users / computers, relying on encryption in the NAS is the best way to move forward. Most NAS vendors use the industry-standard 256-bit AES encryption algorithm. One approach is to encrypt only a particular shared folder while the other approach is to encrypt the full volume. Western Digital supports encryption on a volume basis only.

On the hardware side, encryption support can be in the form of specialized hardware blocks in the SoC (common in ARM / PowerPC based NAS units). In x86-based systems, accelerated encryption support is dependent on whether the AES-NI instruction is available on the host CPU. Rangeley SoCs have AES-NI support and the performance difference between the encrypted and non-encrypted volumes can be expected to be reasonable.

HD Video Playback - Encrypted CIFS

2x HD Playback - Encrypted CIFS

4x HD Playback - Encrypted CIFS

HD Video Record - Encrypted CIFS

HD Playback and Record - Encrypted CIFS

Content Creation - Encrypted CIFS

Office Productivity - Encrypted CIFS

File Copy to NAS - Encrypted CIFS

File Copy from NAS - Encrypted CIFS

Dir Copy to NAS - Encrypted CIFS

Dir Copy from NAS - Encrypted CIFS

Photo Album - Encrypted CIFS

robocopy (Write to NAS) - Encrypted CIFS

robocopy (Read from NAS) - Encrypted CIFS

Read transactions don't have much penalty, but writes to encrypted volumes are much slower compared to non-encrypted volumes. For example, there is a 20 MBps difference in our standard robocopy test of writing a Blu-ray folder to the NAS. Compared to other NAS units, the raw numbers are very good, thanks to the hardware acceleration available. If other Rangeley-based units such as the Synology DS415+ or the Seagate NAS Pro 4-bay are considered, the numbers are more or less the same.

In our first pass with the NASPT benchmark, we saw that the mapped CIFS share from the encrypted volume randomly disconnected from the client during the middle of the fourth pass (the NASPT batch run has five passes of each test). Unfortunately,  this was again not a repeatable issue, as our second batch run completed without problems.

Multi-Client iSCSI Evaluation Miscellaneous Aspects and Final Words
Comments Locked

27 Comments

View All Comments

  • Spoogie - Wednesday, March 4, 2015 - link

    People aren't buying into it. Get over it.
  • pbrutsche - Wednesday, March 4, 2015 - link

    The fact that IT pros haven't adopted ZFS is not related to the RAID5/RAID6 issue; there are other reasons for that.

    I am an IT pro and I GUARANTEE that the issue with a URE (unrecoverable read event) during a RAID rebuild with large capacity drives is a VERY, VERY real concern that EVERYONE - EMC, Dell (MD3k series and EqualLogic), IBM, NetApp, Nimble, etc, etc - talks about, especially as the drives in your array get larger and larger.

    You need to ask Seagate, QNAP and Synology engineers why they don't use ZFS, but I can hazard a guess it comes down to money: the memory requirements to effectively run ZFS is much higher than a more traditional EXT3/EXT4-on-MD setup - the more the better, but 1GB or 2GB isn't going to cut it, and putting more memory in the NAS costs more money (the effective minimum for ZFS is 4GB). Since they have a HUGE investment in a Linux-based architecture switching the OS their appliance runs makes even less sense (my limited experience with ZFS on Linux is that is much less mature than ZFS on FreeBSD).

    One of the reasons IT pro haven't adopted ZFS comes down to this: People who are serious about IT have one saying (among many): You Do Not Frankenstein. Period, End Of Story.

    In terms of storage, home-built ZFS boxes (FreeNAS or whatever) count. So do these cheap (QNAP, Synology, Seagate, etc, etc) NAS appliances. Using one of these Seagate units (or QNAP, or Synology, or whatever) for iSCSI is pretty silly; the lack of redundant storage controllers renders them basically cheap test lab units.

    The only ZFS systems that count as not-frankensteined are boxes built around the SuperMicro SBB (storage bridge bay) chassis running Nexenta (one of the only OSes SuperMicro supports) and the Oracle ZFS Appliance setups.
  • Spoogie - Wednesday, March 4, 2015 - link

    Here's another good read for the skeptics:

    https://www.cafaro.net/2014/05/26/why-raid-5-is-no...
  • bsd228 - Monday, March 9, 2015 - link

    This guy failed statistics. 'Having more drives doesn't increase the risk of a failure event.'

    The problem is you don't care what the odds of 2 drives in the array having a URE. What you care about are the odds that none of the drives have a URE. If you accept his logic, then striped arrays are as safe as single drives.
  • Oyster - Wednesday, March 4, 2015 - link

    This has been discussed numerous times. If you step into the QNAP and Synology world, you'll quickly realize that their solutions are well managed and efficient. In fact, their OSs (as for most other COTS vendors) are *nix distros that give you the full freedom and flexibility that any other FreeNAS or ZFS box would. Oh, and you end saving boatloads of time and effort. The last thing I want to do is spend days updating FreeNAS and/or ZFS (which I have in the past)... and what about the apps you get on QNAP and Synology!

    Ganesh -- you still owe us a proper review of the software ecosystems (at least cover QNAP and Synology). Will help debunk some of these "myths" and, of course, make for a good read!
  • Gray05 - Wednesday, March 4, 2015 - link

    I just bought a Synology DS415+. I bought it after heavily weighing the option of building my own machine. I'm not an expert in this area, but I have no doubt I could learn anything I need to and take care of myself. But, the ultimate deciding factor was that I just didn't want to sacrifice any more of my own time than I have to. It would be fun to follow your suggestion, but I just don't have the time to throw at it to learn and troubleshoot when something goes wrong.

    There's a guy like you on every website or forum I've read on the topic. There's validity to what you're saying. But, my time is worth more than the premium I paid for my NAS. I plugged it in, it worked, and it hasn't shown any sign of not working yet. My applications don't demand extreme data loss prevention. I believe in redundant backups and I won't be in any trouble to lose any info between my last backup and a catastrophic failure.

    There is absolutely a market for these devices. You just aren't in it. And that's fine. It's not feasible for me to DIY everything.
  • rtho782 - Thursday, March 5, 2015 - link

    I wanted to love FreeNas/Nas4Free, the Atom board I wanted to use didn't work well so I gave it a quad core Haswell i5 and 24GB ram, it was still horribly slow to do anything, the apps didn't work properly, it was a nightmare.

    At least these COTS devices "just work".
  • Navvie - Monday, March 16, 2015 - link

    I can't speak for FreeNAS, but nas4free is certainly a product that 'just works'. You did something wrong.
  • Das Capitolin - Thursday, March 5, 2015 - link

    I must have missed something. Isn't this 2015, and doesn't RAID5 still work? It seems to me that someone making such audacious claims that have since been repeatedly disproven would not be used to support your argument.
  • hlmcompany - Wednesday, March 4, 2015 - link

    Ganesh, are the GbE ports "Marvell Alaska 88E1512" or Marvell Alaska 88E1518?

Log in

Don't have an account? Sign up now