Synology DS214play: Intel Evansport Almost Done Right

Encryption Support Evaluation - Single Client CIFS on Windows

Consumers looking for encryption capabilities can opt to encrypt a iSCSI share with TrueCrypt or some in-built encryption mechanism in the client OS. However, if requirements dictate that the data must be shared across multiple users / computers, relying on encryption in the NAS is the best way to move forward. Most NAS vendors use the industry-standard 256-bit AES encryption algorithm. One approach is to encrypt only a particular shared folder while the other approach is to encrypt the full volume. Synology supports only folder-level encryption in DSM.

On the hardware side, encryption support can be in the form of specialized hardware blocks in the SoC (common in ARM / PowerPC based NAS units). In x86-based systems, accelerated encryption support is dependent on whether the AES-NI instruction is available on the host CPU. The Atom CPU in the Evansport SoC doesn't support AES-NI, but the SoC does have a security engine. Unfortunately, Synology's firmware doesn't take advantage of the security engine's APIs. The encryption is done using the host CPU and the performance is hit heavily. We enabled encryption on a a CIFS share to repeat our Intel NASPT / robocopy benchmarks. The results are presented in the graph below.

Enabling encryption pulls down the performance numbers, most times by more than 50%. If encryption is important, it might be better to wait for the next generation of Atom-based NAS units (the new Atom CPUs have AES-NI) or opt for a higher-end unit sporting a CPU with AES-NI capabilities. On the other hand, the hardware-accelerated transcoding capabilities are lost with other platforms.