Configuring the key management server

To use a key management server, you must configure the network connection settings and back up the data encryption keys to the key management server.

CautionEncryption keys backed up on the key management server are managed with the client certificate. If the client certificate is lost, and the SVP is replaced due to a failure, you cannot restore the encryption keys that were backed up before the SVP replacement.

In addition, when the connection settings are backed up to the key management server, the system does not back up the client certificate. Make sure that you back up a copy of the connection settings to the key management server and save a copy of the client certificate separately. Refer to your corporate security policy for procedures related to backups.

CautionTo protect the key encryption key at the key management server, the key management server must be configured using two clustered servers. For this reason, you must enable the secondary server.
Note
  • If you use a V-VOL, you will need encryption/unencryption formatting for the V-VOL.
  • To connect to the key management server by host name instead of IP address, send the IP address of the DNS server to your service representative and request that the service representative configure the SVP.

Before you begin

  • You must have the Security Administrator (View & Modify) role.
  • Verify that the client and root certificates are uploaded to the key management server. If the certificates are not uploaded, contact the key management server administrator.
  • If you are configuring regularly scheduled backups, create a regular backup user. For details about how to create users, see the Virtual Storage Platform G1000 System Administrator Guide.

Procedure

  1. Display the Device Manager - Storage Navigator main window.

  2. Expand Administration in the Explorer pane, and select Encryption Keys.

  3. In the Encryption Keys window, select the Encryption Keys tab.

  4. Click Edit Encryption Environmental Settings.

  5. In the Edit Encryption Environmental Settings window, for Key Management Server, select Enable.

  6. Expand Server Settings and specify the Primary Server information.

  7. For Secondary Server, select Enable and specify the settings for the secondary server.

  8. For Server Configuration Test, click Check to test the connection. Error messages appear if the server configuration test fails.

  9. To generate an encryption key on the key management server, select Generate Encryption Keys on Key Management Server.

    To store the encryption key on the key management server, select Protect the Key Encryption Key on the Key Management Server, then I Agree.
    CautionIf you have selected Protect the Key Encryption Key on the Key Management Server in Generate Encryption Keys on Key Management Server, the storage system will try to get encryption keys backed up on the key management server once the storage system is turned on. Therefore, it is recommended that you confirm that the SVP is connected to the key management server properly before turning the storage system on.

  10. To schedule a regular backup, select Enable Encryption Key Regular Backup to Key Management Server, and then select backup times from Regular Backup Time.

  11. Enter the user name and password for the regular backup user in Regular Backup User.

  12. To generate an encryption key on the key management server without creating an encryption key in the storage system, select Disable Local Key Generation. Confirm the Warning that displays and select I Agree.

    CautionWhen you select the Disable local key generation and I Agree check-boxes in Generate Encryption Keys on Key Management Server and finished the settings, you cannot undo this action.

  13. Click Next.

  14. In the Confirm window, confirm the settings, and enter your task name in Task Name, and then click Apply.

    If you want the Task window to open after you click Apply, select Go to tasks window for status.

Results

The connection to the key management server is set up.
ImportantIf the key management server is unavailable after you complete this task, the settings may be incorrect. Contact the server or network administrator.

Next steps

  1. Save a back up copy of the client certificate.
  2. Back up the connection settings to the key management server configuration files by downloading the configuration files to a folder. You can then use the backup copies to restore one or more configuration files if it becomes necessary.

    For instructions, see the Virtual Storage Platform G1000 System Administrator Guide.

Related Tasks
Parent Topic