Backing up encryption keys

Your storage system automatically creates a primary backup of the encryption keys. To ensure data availability, you should also create secondary backups of the encryption keys immediately after creating the keys, and on a regularly scheduled basis.

CautionSecurely store the secondary backup data encryption key. Include this process in your corporate security policy.

If the primary data encryption license key becomes unavailable and a secondary backup data encryption key does not exist, the system cannot decrypt encrypted data.

DEKs and CEKs that you create are backed up in batch.

You can back up encryption keys to a file, or to a key management server. You can also schedule regular backups when you configure the key management server in the Edit Encryption Environmental Settings window.

It is recommended that you back up all keys after you perform any of the following operations:

  • Create encryption keys
  • Add, remove, or replace drives
  • Add, remove, or replace EBEDs
  • Replace controllers
  • Update CEKs
  • Update KEKs
Parent Topic
  • Creating and backing up encryption keys

    Encryption keys are commonly created in the storage system. However, when the key management server is in use, and Generate Encryption Keys on Key Management Server is checked in the Edit Encryption Environmental Settings window, encryption keys are created on a key management server and used in the storage system.

Child Topics