Bringing Quantum Resistance to Cisco MDS 9000 with TrustSec FC Link Encryption

[ad_1] As safety laws tighten and quantum computing advances, organizations are prioritizing cybersecurity, making encryption more and more important. The Cisco MDS 9000 household of storage networking units affords cutting-edge encryption options, particularly by Cisco TrustSec Fibre Channel Hyperlink Encryption, making certain safe knowledge transmission throughout Fibre Channel (FC) networks.

Threats and safety laws mandate stronger safety postures Knowledge is among the many most essential belongings for any company, so defending knowledge from unauthorized entry and misuse is a key concern. With the emergence of hybrid work, the adoption of cloud companies, and the malicious use of AI-based instruments, cyberthreats have change into extra superior and impactful. On the similar time, new privateness and safety laws are mandating that organizations obtain a greater, extra complete safety posture. Because of this, cybersecurity is the highest precedence amongst AI deployments, in keeping with the Cisco 2024 AI Readiness Index, and knowledge encryption is now in excessive demand from companies of all sizes and industries.

With FC being the protocol of selection for accessing business-critical enterprise datasets, an essential aspect of a safety posture is to validate the identification of adjoining switches and to encrypt knowledge whereas in transit on a storage space community (SAN). These capabilities are supplied on the Cisco MDS 9000 household of storage networking units utilizing Cisco TrustSec FC Hyperlink Encryption. With latest NX-OS code, a brand new cypher has been launched to resist the brute-force calculations that may overcome present encryption requirements with quantum computing, that includes a simple configuration. Out there underneath Benefit and Premier license tiers, this characteristic helps director switches, mounted configuration switches, and multiprotocol switches, benefiting each mainframe and open system environments.

Authentication is a prerequisite to encryption Cisco MDS 9000 Collection Switches implement the Fibre Channel Safety Protocol (FC-SP-2 commonplace, ANSI INCITS 496-2012), enabling switch-to-switch and host-to-switch authentication to deal with safety challenges in enterprise materials. The Diffie-Hellman Problem Handshake Authentication Protocol (DHCHAP) is a FC-SP protocol that gives authentication between Cisco MDS 9000 Collection Switches and different units. DHCHAP combines the CHAP protocol with the Diffie-Hellman (DH) change, making certain that solely trusted units can be a part of a material, thereby stopping unauthorized entry.

DHCHAP is a safe, password-based key-exchange authentication protocol supporting each switch-to-switch and host-to-switch authentication. This configuration requires setting native and peer change passwords, with DHCHAP negotiating hash algorithms and DH teams. With NX-OS 9.4(3), SHA-1 algorithm-based authentication is default, configured on the bodily FC interface stage.

Cisco TrustSec Fibre Channel Hyperlink Encryption The Superior Encryption Commonplace (AES) is a high-security, symmetric-key block-cipher algorithm adopted globally since 2002. It helps numerous functions, together with disk encryption, VPN programs, and messaging packages. Its substitution-permutation community includes subtle bit operations, with hardware-efficient execution.

Cisco TrustSec FC Hyperlink Encryption extends the Fibre Channel Safety Protocol (FCSP), making certain transaction integrity and confidentiality utilizing DHCHAP for peer authentication. Encryption configuration includes defining safety associations on interfaces, setting a key and utilizing a salt for enhancing safety by differentiating encrypted textual content patterns.

Cisco TrustSec FC Hyperlink Encryption allows AES-GCM (default, encryption and authentication) or AES-GMAC (authentication solely). Key lengths supported are 128 bits for 32G units and each 128-bit and 256-bit for 64G units, providing flexibility and selection. If executed in software program, AES-128 is marginally sooner and desires much less system sources, whereas AES-256 offers better resilience in opposition to brute-force assaults and elevates the answer to change into quantum resistant. Cisco MDS 9000 switches leverage superior hardware-assisted AES implementation in order that each AES-128 and AES-256 execute with the identical optimum stage of efficiency.

Business-leading efficiency and throughput The Cisco 64G FC switching module offers excessive encryption capabilities, supporting eight ports at 64G speeds every, attaining 512G mixture encrypted throughput per module. This industry-leading efficiency outcomes from superior ASIC design, dealing with encryption with no efficiency penalty. The shop-and-forward structure ensures unchanged latency between encrypted and non-encrypted configurations, making MDS 9000 SAN switches distinctive in sustaining effectivity with the very best stage of safety. Fastened configuration and multiservice switches leverage the identical capabilities, however the variety of encrypted ports relies on the change mannequin. For instance, on Cisco MDS 9124V there are 4 ports that may be encrypted, on Cisco MDS 9148V there are eight, and on Cisco MDS 9396V there are 16.

Port independence and repair availability In real-world deployments, port independence is essential for sustaining connectivity throughout disruptions. Cisco MDS 9000 Collection Switches excel on this, with an optimized ASIC structure and body path separation making certain no affect on different encrypted ports throughout occasions like port errdisable or cable/SFP pull. This functionality enhances service availability considerably.

Cloth switches like Cisco MDS 9124V, 9148V, and 9396V help a number of encrypted ports with out lowering the full variety of usable ports, in contrast to competing merchandise. This functionality ensures constant useful resource allocation no matter encryption standing.

Distance help and SAN analytics compatibility Enabling encryption on MDS 9000 Collection units doesn't have an effect on supported distances, preserving buffer credit and permitting unaltered long-distance operations. Customers can keep the identical distance capabilities with encryption, eliminating design constraints throughout safety planning.

Cisco SAN Analytics offers deep visitors visibility and is the {industry} benchmark. It may be absolutely relevant to encrypted visitors, sustaining assurance and insights with out compromising visibility. The superior structure of the Cisco MDS 9000 Collection ensures that it's all the time doable to examine headers, in order that SAN Analytics might be utilized to encrypted visitors getting into the change or leaving it.

Key size, rekeying, and quantum resistance AES-GCM helps 128- and 256-bit keys. Key choice on 64G units affords flexibility, with handbook periodic rekeying out there as a further safety measure. AES-256 is favored for quantum resistance and safety in opposition to the rising threats posed by quantum computer systems, at the side of Grover’s algorithm. The improved TrustSec functionality on MDS 9000 is taken into account safe at the very least till 2050, as per ETSI GR QSC 006 V1.1.1, future-proofing safety efforts.

Complete safety suite The Cisco MDS 9000 Collection affords intensive security measures, each intrinsic and configurable. Intrinsic options embrace Safe Boot and Anti-counterfeit know-how, whereas configurable choices embody VSANs, laborious zoning, port safety, cloth binding, safe syslog logging, safe erase, Transport Layer Safety (TLS) 1.3, Easy Community Administration Protocol Model 3 (SNMPv3), Safe Shell Model 2 (SSHv2), amongst others. These options help enterprise continuity and catastrophe restoration throughout knowledge facilities, providing encryption on FC and FC over IP (FCIP) Inter-Change Hyperlinks (ISLs) by TrustSec and IPsec know-how, respectively (Determine 1).

<img class="wp-image-472165 size-medium_large" src="https://storage.googleapis.com/blogs-images-new/ciscoblogs/1/2025/04/250415_MDS9000_Encryption_Figure_1-768x397.png" alt="Flow chart displaying link layer security and hybrid SAN extensions using TrustSec and IPsec technologies, including specs for TrustSec and IPsec." width="768" height="397" srcset="https://storage.googleapis.com/blogs-images-new/ciscoblogs/1/2025/04/250415_MDS9000_Encryption_Figure_1-768x397.png 768w, https://storage.googleapis.com/blogs-images-new/ciscoblogs/1/2025/04/250415_MDS9000_Encryption_Figure_1-300x155.png 300w, https://storage.googleapis.com/blogs-images-new/ciscoblogs/1/2025/04/250415_MDS9000_Encryption_Figure_1-1024x530.png 1024w, https://storage.googleapis.com/blogs-images-new/ciscoblogs/1/2025/04/250415_MDS9000_Encryption_Figure_1-1536x795.png 1536w, https://storage.googleapis.com/blogs-images-new/ciscoblogs/1/2025/04/250415_MDS9000_Encryption_Figure_1.png 2000w" sizes="(max-width: 768px) 100vw, 768px"/> Determine 1. MDS 9000 encryption, overlaying enterprise continuity and catastrophe restoration wants Conclusion Cisco MDS 9000 switches ship unmatched encryption for SANs, distinguished by superior ASIC design, superior {hardware} structure, and complex software program management. TrustSec FC Hyperlink Encryption is significant for securely interconnecting SAN materials throughout knowledge facilities utilizing FC hyperlinks. With Cisco MDS 9000 64G units, you may prolong SANs securely, enhancing the safety posture in preparation for quantum computing with out compromise.

Further sources:Cisco MDS 9000 Collection Safety Configuration GuideCisco Storage Space NetworkingStorage networking productsWhat is a storage space community (SAN)?