Encryption keys are commonly created in the storage system. However, when the key management server is in use, and
Generate Encryption Keys on
Key Management Server is checked in the
Edit Encryption Environmental Settings window, encryption keys are created on a key management server and used in the storage system.
This topic describes the instructions for creating and backing up the data encryption keys. You can save secondary backups of encryption keys to a file or to the key management server. You can also schedule regular backups of encryption keys.
The VSP Gx00 models and VSP Fx00 models provide a performance-friendly AES-256-XTS encryption capability on the back-end I/O director. This capability protects data at rest on internal storage media (including disk drives and flash drives) attached to those directors. While many levels of encryption are available to the enterprise, protecting data at rest by using the array-level encryption of the storage system provides the following advantages: causes minimal to no performance impact within your operations, remains transparent to existing host servers and switches, shreds storage media by deleting the encryption key, simplifies key management to reduce the risk of the loss of encryption keys and data, and supports logging of encryption and key management events. In addition, many regulations encourage or require encryption of personally identifiable information (PII) and other sensitive data. Array-level encryption handles this type of data as well.
Your storage system automatically creates a primary backup of the encryption keys. To ensure data availability, you should also create secondary backups of the encryption keys immediately after creating the keys, and on a regularly scheduled basis.
