IBM Storwize V5020 User Manual

Chapter 13. Encryption 759
Support for simultaneous use of both USB flash drives and a key server is available in IBM
Spectrum Virtualize code V8.1 and later. Organizations that use encryption key management
servers might consider parallel use of USB flash drives as a backup solution. During normal
operation such drives could be disconnected and stored in a secure location. However, in the
event of a catastrophic loss of encryption servers, the USB drives could still be used to unlock
the encrypted storage.
The following list of key server and USB flash drive characteristics might help you to choose
the type of encryption key provider that you want to use.
Key servers can have the following characteristics:
򐂰 Physical access to the system is not required to perform a rekey operation.
򐂰 Support for businesses that have security requirements precluding use of USB ports.
򐂰 Possibility to use Hardware Security Modules (HSMs) for encryption key generation.
򐂰 Ability to replicate keys between servers and perform automatic backups.
򐂰 Implementations follow an open standard (KMIP) that aids in interoperability.
򐂰 Ability to audit operations related to key management.
򐂰 Ability to separately manage encryption keys and physical access to storage systems.
USB flash drives have the following characteristics:
򐂰 Physical access to the system might be required to process a rekey operation.
򐂰 No moving parts with almost no read or write operations to the USB flash drive.
򐂰 Inexpensive to maintain and use.
򐂰 Convenient and easy to have multiple identical USB flash drives available as backups. You
can just copy them if needed.
13.4.1 Starting the Enable Encryption wizard
After the license activation step is successfully completed, you can now enable encryption.
You can enable encryption after completion of the initial system setup using either GUI or CLI.
There are two ways in the GUI to start the Enable Encryption wizard. It can be started by
clicking Run Task button next to Enable Encryption on the Suggested Tasks window as
shown in Figure 13-21.
Figure 13-21 Enable Encryption from the Suggested Tasks window
Important: Maintaining confidentiality of the encrypted data hinges on security of the
encryption keys. Pay special attention to ensuring secure creation, management and
storage of the encryption keys.

IBM Storwize V5020 Specifications

General

Model	Storwize V5020
Category	Storage
Maximum Number of Drives	240
Form Factor	2U
Supported Protocols	iSCSI
Drive Types Supported	SSD, SAS, NL-SAS
Expansion Units	Up to 9
RAID Levels Supported	0, 1, 5, 6, 10
Host Interface	16 Gb FC, 10 Gb iSCSI
Interface Types	Fibre Channel, Ethernet, SAS
Power Supply	Dual redundant power supplies

Summary

Overview of the IBM Storwize V5000 Gen2 system

IBM Storwize V5000 Gen2 overview

Provides an overview of the Gen2 system, its models, and benefits.

IBM Storwize V5000 Gen2 models

Compares the features and specifications of different Storwize V5000 Gen2 models.

IBM Storwize V5000 Gen2 hardware

Describes the hardware components of the Storwize V5000 Gen2 solution.

Initial configuration

Hardware installation planning

Outlines requirements and checklist for planning hardware installation.

SAN configuration planning

Discusses planning for Fibre Channel SAN connectivity.

First-time setup

Guides through the initial setup process for a first-time IBM Storwize V5000 Gen2 service.

Initial configuration

Details how to complete the initial configuration, including component verification.

Storage pools

Working with internal drives

Describes configuring internal storage disk drives and actions on them.

Working with storage pools

Explains how storage pools are managed and created.

Working with managed disks

Details how to manage MDisks, including their modes and assignments.

Host configuration

Preparing the host operating system

Details steps to prepare Windows and VMware ESXi hosts for attachment.

Creating hosts by using the GUI

Guides on creating Fibre Channel, iSCSI, and SAS hosts.

Volume configuration

Creating volumes using the Volume Creation

Details creating basic, mirrored, custom, and HyperSwap volumes.

Mapping a volume to the host

Guides on mapping created volumes to hosts.

Storage migration

Storage migration wizard overview

Storage migration wizard

Details the steps involved in the storage migration wizard.

Advanced host and volume administration

Advanced host administration

Covers host modification, mappings, and deletion.

Advanced volume administration

Details volume modification and copy creation.

Advanced features for storage efficiency

Easy Tier

Describes the Easy Tier disk performance optimization function.

Thin provisioning

Real-time Compression software

Details the Real-time Compression software for storage efficiency.

Copy services

IBM FlashCopy

Describes the FlashCopy function for point-in-time copies.

Implementing FlashCopy

Remote Copy

Troubleshooting remote copy

HyperSwap

Explains HyperSwap functionality for high availability.

External storage virtualization

Planning for external storage virtualization

Describes planning steps for virtualizing external storage.

Working with external storage

RAS, monitoring, and troubleshooting

Reliability, availability, and serviceability features

Describes RAS features and monitoring.

Configuration backup

Explains how to back up system configuration.

System update

Describes updating node canister software and drive firmware.

Support Assistance

Describes local and remote support assistance.

Collecting support information

Details how to collect support data using GUI and CLI.

Powering off the system and shutting down the infrastructure

Encryption

Planning for encryption

Discusses planning for data-at-rest encryption.

Defining encryption of data at-rest

Activating encryption

Guides on activating encryption licenses.

Enabling encryption

Details enabling encryption using key servers or USB flash drives.

Rekeying an encryption-enabled system

CLI setup and SAN Boot

Command-line interface