The following table shows functions for SED authentication keys and key management server link-
age.
Table 23 Functional Comparison between the SED Authentication Key (Common Key) and Key Man-
agement Server Linkage
Function SED authentication key Key Management Server Linkage
Key creation In the storage system Key server
Key storage In the storage system Key server
Key renewal (auto/manual) No Yes
Key compromise (*1) No Yes
Key backup No Yes
Target RAID groups RAID groups (Standard, WSV, SDV), REC Disk Buffers, SDPs, TPPs,
FTRPs, and FTSPs (*2)
*1 : The key becomes unavailable in the key server.
*2: The SED key group must be enabled after a pool or REC Disk Buffer is created, or after a pool
capacity is expanded.
An authentication key to access data of the RAID groups that are registered in a key group can be
managed by the key server.
RAID groups that use the same authentication key must be registered in the key group in advance.
Authentication for accessing the RAID groups that are registered in the key group is performed by
acquiring the key automatically from the key server when an
ETERNUS DX is started.
As a key server for the key management server linkage, use a server that has the key management
software installed. Only the following two key management software products can be used.
•
ETERNUS SF KM
•
IBM Security Key Lifecycle Manager
Figure 38 Key Management Server Linkage
ETERNUS DX
RAID group
Global ho
t spare
Common key
Exclusive
authentication
key for a group
RAID group RAID group
Key group
Key group
Key server
Business server
An ETERNUS DX uses the authentication
key that is stored in the key server
in order to unlock the encryption.
2. Basic Functions
Data Encryption
68
Fujitsu Storage ETERNUS DX100 S4/DX200 S4, ETERNUS DX100 S3/DX200 S3 Hybrid Storage Systems
Design Guide (Basic)
Copyright 2023 Fujitsu Limited
P3AM-7642-32ENZ0
To Next Page
Loading...
