Figure 12-1 shows an encryption example. Encrypted disks and encrypted data paths are  marked in blue. Unencrypted disks and data paths are marked in red. The server sends  unencrypted data to a SAN Volume Controller 2145-DH8 system, which stores  hardware-encrypted data on internal disks. The data is mirrored to a remote Storwize V7000  Gen1 system using Remote Copy. The data flowing through the Remote Copy link is not  encrypted. Because the Storwize V7000 Gen1 (2076-324) cannot perform any encryption  activities, data on the Storwize V7000 Gen1 is not encrypted. To enable encryption of both data copies, the Storwize V7000 Gen1 must be replaced by an  encryption capable IBM Spectrum Virtualize system, as shown in Figure 12-2. After such  replacement, both copies of data are encrypted, but the Remote Copy communication  between both sites remains unencrypted. Figure 12-3 shows an example configuration that uses software and hardware encryption.  Software encryption is used to encrypt an external virtualized storage system (2076-324 in  Figure 12-3). Hardware encryption is used for internal, SAS-attached disk drives. Server Hardware Encryption Software Encryption SAS FC 2145-SV1 2145-24F 2145-24F 2076-324 Hardware Encryption Remote Copy Server 2145-DH8 2076-524 2145-24F 2145-24F 2076-24F 2076-24F SAS SAS Server Hardware Encryption 2145-DH8 2076-324 SAS 2145-24F 2145-24F 2076-224 2076-224 Remote Copy SAS Figure 12-1 Encryption on single site Figure 12-2 Encryption on both sites Figure 12-3 Example of software encryption and hardware encryption 606  Implementing the IBM Storwize V7000 with IBM Spectrum Virtualize V8.2.1