HP Cisco MDS 9020 Cisco MDS 9000 Family Storage Media Encryption Configuration - Page 22

Key Management, End-to-end key management using HTTPS/SSL/SSH.

Get HP Cisco MDS 9020 - Fabric Switch PDF manuals and user guides View all HP Cisco MDS 9020 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 22 highlights

About Cisco Storage Media Encryption Chapter 1 Product Overview Send documentation comments to [email protected] Key Management Cisco Key Management Center (KMC) provides essential features such as key archival, secure export and import, and key shredding. Key management features include the following: • Master key resides in smart cards. • Quorum (2 out of 5) of smart cards required to recover the master key. • Unique key per tape. • Keys reside in clear-text only inside a FIPS boundary. • Tape keys and intermediate keys are wrapped by the master key and deactivated at the Key Management Center. • Option to store tape keys on tape media. The centralized key lifecycle management includes the following: • Archive, shred, recover, and distribute media keys. - Integrated into Fabric Manager Server. - Secure transport of keys. • End-to-end key management using HTTPS/SSL/SSH. - Access controls and accounting. - Use of existing AAA mechanisms. The Cisco KMC provides dedicated key management for Cisco SME, with support for single and multisite deployments. The Cisco KMC performs key management operations. The Cisco KMC is either integrated or separated from Fabric Manager depending on the deployment requirements. Single site operations can be managed by the integration of the Cisco KMC in Fabric Manager. In multisite deployments, the centralized Cisco KMC can be used together with the local Fabric Manager servers that are used for fabric management. This separation provides robustness to the KMC and also supports the storage media encryption deployments in different locations sharing the same Cisco KMC. Figure 1-2 shows how Cisco KMC is separated from Fabric Manager for a multisite deployment. A Cisco KMC is configured only in the primary data center and Fabric Manager servers are installed in all the data centers to manage the local fabrics and provision storage media encryption. The storage media encryption provisioning is performed in each of the data centers and the tape devices and backup groups in each of the data centers are managed independently. Cisco MDS 9000 Family Storage Media Encryption Configuration Guide 1-4 OL-18091-01, Cisco MDS NX-OS Release 4.x

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
Send documentation comments to [email protected]
1-4
Cisco MDS 9000 Family Storage Media Encryption Configuration Guide
OL-18091-01, Cisco MDS NX-OS Release 4.x
Chapter 1
Product Overview
About Cisco Storage Media Encryption
Key Management
Cisco Key Management Center (KMC) provides essential features such as key archival, secure export
and import, and key shredding.
Key management features include the following:
•
Master key resides in smart cards.
•
Quorum (2 out of 5) of smart cards required to recover the master key.
•
Unique key per tape.
•
Keys reside in clear-text only inside a FIPS boundary.
•
Tape keys and intermediate keys are wrapped by the master key and deactivated at the Key
Management Center.
•
Option to store tape keys on tape media.
The centralized key lifecycle management includes the following:
•
Archive, shred, recover, and distribute media keys.
–
Integrated into Fabric Manager Server.
–
Secure transport of keys.
•
End-to-end key management using HTTPS/SSL/SSH.
–
Access controls and accounting.
–
Use of existing AAA mechanisms.
The Cisco KMC provides dedicated key management for Cisco SME, with support for single and
multisite deployments. The Cisco KMC performs key management operations.
The Cisco KMC is either integrated or separated from Fabric Manager depending on the deployment
requirements.
Single site operations can be managed by the integration of the Cisco KMC in Fabric Manager. In
multisite deployments, the centralized Cisco KMC can be used together with the local Fabric Manager
servers that are used for fabric management. This separation provides robustness to the KMC and also
supports the storage media encryption deployments in different locations sharing the same Cisco KMC.
Figure 1-2
shows how Cisco KMC is separated from Fabric Manager for a multisite deployment.
A Cisco KMC is configured only in the primary data center and Fabric Manager servers are installed in
all the data centers to manage the local fabrics and provision storage media encryption. The storage
media encryption provisioning is performed in each of the data centers and the tape devices and backup
groups in each of the data centers are managed independently.