HP Cisco MDS 9124 Cisco MDS 9000 Family Storage Media Encryption Configuration - Page 116

Cisco Key Management Center Chapter 6 Cisco SME Key Management Send documentation comments to [email protected] Master Key When a Cisco SME cluster is created, a security engine generates the master key. Considering that a single fabric can host more than one cluster, for example, to support the needs of multiple business groups within the same organization, there will be as many master keys as there are clusters. Each master key is unique and it is shared across all cluster members. The master key is used to wrap the tape volume group keys. Tape Volume Group Key The tape volume group key is used to encrypt and authenticate the tape volume keys which are the keys that encrypt all tapes belonging to the same tape volume group. A tape volume group can be created on the basis of a bar code range for a set of backup tapes or it can be associated with a specific backup application. Tape volume group keys are occasionally rekeyed for increased security or when the security of the key has been compromised. Tape Volume Key The tape volume key is used to encrypt and authenticate the data on the tapes. In unique key mode, the tape volume keys are unique for each physical tape and they can be stored in the Cisco KMC or stored on the tape. The Cisco KMC database does not need to store a tape volume key if the key is stored on the tape itself. The option to store the key on the tape may dramatically reduce the number of keys stored on the Cisco KMC. In shared key mode, there is one tape volume key which is used to encrypt all volumes in a volume group. Cisco Key Management Center The Key Management Center (Cisco KMC) is the centralized management system that stores the key database for active and archived keys. The keys stored in the Cisco KMC are not usable without the master key. To manage the potential increase in tape volume keys, Cisco SME provides the option to store the tape volume key on the tape itself. In this case, the Cisco KMC stores the tape volume group keys. This option exponentially increases the number of managed tapes by reducing the number of keys stored on the Cisco KMC. However, this option also restricts the capability of purging keys at a later time. The Cisco KMC provides the following advantages: • Centralized key management to archive, purge, recover, and distribute tape keys • Integrated into Fabric Manager Server depending on the deployment requirements. • Integrated access controls using AAA mechanisms. Note The Cisco KMC listens for key updates and retrieves requests from switches on a TCP port. The default port is 8800; however, the port number can be modified in the smeserver.properties file. Cisco MDS 9000 Family Storage Media Encryption Configuration Guide 6-2 OL-18091-01, Cisco MDS NX-OS Release 4.x