HP 8/80 Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June - Page 164

3 Data re-keying Data re-keying In a re-keying operation, encrypted data on a LUN is decrypted with the current key, re-encrypted with a new key and written back to the same LUN at the same logical block address (LBA) location. This process effectively re-encrypts the LUN and is referred to as "in-place re-keying." It is recommended you limit the practice of re-keying to the following situations: • Key compromise as a result of a security breach. • As a general security policy to be implemented as infrequently as every 6 months or once per year. Re-keying is only applicable to disk array LUNs or fixed block devices. There is no re-keying support for tape media. If there is a need to re-encrypt encrypted tape contents with a new key, the process is equivalent to restoring the data from tape backup. You decrypt the data with the old DEK and subsequently back up the tape contents to tape storage, which will have the effect of encrypting the data with the new DEK. Resource Allocation A maximum of ten concurrent rekey sessions are supported per Encryption Group, with a maximum of ten concurrent re-key/encryption sessions per target container and 10 concurrent sessions per physical initiator. If your configuration has two containers that are accessed by the same physical initiator, you cannot have more than ten concurrent re-key or encryption sessions. This includes both re-key (auto and manual) and first time encryption sessions. When scheduled re-key or first time encryption sessions exceed the maximum allowable limit, these sessions will be pending and a Temporarily out of resources message is logged. Whenever an active re-key of first time encryption session completes, the next pending session is scheduled. The system checks once every hour to determine if there are any re-key or first time encryption sessions pending. If resources are available, the next session in the queue is processed. There may be up to an hour lag before the next session in the queue is processed. It is therefore recommended that you do not schedule more than ten re-key or first time encryption sessions. Re-keying modes Re-keying operations can be performed under the following conditions: • Offline re-keying - The hosts accessing the LUN are offline, or host I/O is halted. • Online re-keying - The hosts accessing the LUN are online, and host I/O is active. 146 Fabric OS Encryption Administrator's Guide 53-1001864-01