748 Implementing the IBM Storwize V5000 Gen2 with IBM Spectrum Virtualize V8.1
Both methods of encryption use the same encryption algorithm, the same key management
infrastructure, and the same license.
13.2.2 Encryption keys
Hardware and software encryption use the same encryption key infrastructure. The only
difference is the object that is encrypted by using the keys. The following objects can be
encrypted:
Pools (software encryption)
Child pools (software encryption)
Arrays (hardware encryption)
Encryption keys can be described as follows:
Keys are unique for each object, and they are created when the object is created.
Two types of keys are defined in the system:
– Master access key:
• The master access key is created when encryption is enabled.
• The master access key can be stored on USB flash drives and/or a key server(s).
One master access key is created for each enabled encryption key provider.
• It can be copied or backed up as necessary.
• It is
not permanently stored anywhere in the system.
• It is required at boot time to unlock access to encrypted data.
– Data encryption keys (one for each encrypted object):
• Data encryption keys are used to encrypt data. When an encrypted object (such as
an array, a pool, or a child pool) is created, a new data encryption key is generated
for this object.
• Managed disks (MDisk) that are not self-encrypting are automatically encrypted
using the data encryption key of the pool or child pool that they belong to.
• Managed Disks (MDisks) that are self-encrypting will not be re-encrypted using the
data encryption key of the pool or child pool they belong to by default. You can
override this default by manually configuring the MDisk as not self-encrypting.
• Data encryption keys are stored in secure memory.
• During cluster internal communication data encryption keys are encrypted with the
master access key.
• Data encryption keys cannot be viewed.
• Data encryption keys cannot be changed.
• When an encrypted object is deleted, its data encryption key is discarded (
secure
erase
).
Note: The design for encryption is based on the concept that a system should either be
encrypted or not encrypted. Encryption implementation is intended to encourage solutions
that contain only encrypted volumes or only unencrypted volumes. For example, once
encryption is enabled on the system, all new objects (for example, pools) are by default
created as encrypted.
To Next Page
Loading...
Need help?
General