Brocade Network Advisor SAN User Manual v12.3.0 - Manual (Page 785)

Brocade Network Advisor SAN User Manual 733
53-1003154-01
Steps for connecting to an ESKM/SKM appliance
20
Data Encryption Keys
The following sections describe Data Encryption Key (DEK) behavior during DEK creation, retrieval,
and updates as they relate to disk keys and tape pool keys, and tape LUN and DF-compatible tape
pool support:
Disk keys and tape pool keys support
Data Encryption Key (DEK) creation, retrieval, and update for disk and tape pool keys are as
follows:
• DEK creation: The DEK is first archived using the session list available for the configured
ESKMs/SKMsin the cluster. After the DEK is archived successfully, it gets synchronized with
other ESKMs/SKMs in the cluster. If archival is succesful, the DEK is then read from both the
primary and secondary ESKMs/SKMs in the cluster until the DEK is read successfully from
both.If the set of operations is successful, the DEK created can be used for encrypting disk
LUNs or tape pools in Brocade native mode. If key archival of the DEK to the ESKM/SKM
cluster fails, an error is logged and the operation is retried. If the failure occurs during DEK
retrieval after successful archival to one of the ESKMs/SKMs, or synchronization to any
ESKMS/SKMs in the cluster times out, an error is logged and the operation is retried. Any DEK
archived in this case is not used.
- If key archival of the DEK to the ESKM/SKM cluster is successful, the DEK is read from
either the primary or secondary ESKMs or SKMs in the cluster until the DEK is read
successfully from both. If successful, then the DEK created can be used for encrypting
disk LUNs or tape pools in Brocade native mode.
- If key archival of the DEK to the ESKM/SKM cluster fails, an error is logged and the
operation is retried. If the failure occurs after archival to one of the ESKMs or SKMs, but
synchronization to all ESKMS or SKMs in the cluster times out, then an error is logged and
the operation is retried. Any DEK archived in this case is not used.
• DEK retrieval: The DEK is retrieved from the ESKM/SKM cluster using the session list
available from the configured ESKMs/SKMs in the cluster. If the DEK retrieval fails, it is retried.
• DEK update: DEK update behavior is the same as DEK creation.
Tape LUN support
Data Encryption Key (DEK) creation, retrieval, and update for tape LUNs are as follows:
• DEK creation: The DEK is created and archived to the ESKM/SKM cluster using the using the
session list available for configured ESKMs/SKMs in the cluster. The DEK is synchronized with
other ESKMs/SKMs in the cluster. Upon successful archival of the DEK to the ESKM/SKM
cluster, the DEK can be used for encryption of the tape LUN. If archival of the DEK to the
ESKM/SKM cluster fails, an error is logged and the operation is retried.
• DEK retrieval: The DEK is retrieved from the ESKM/SKM cluster using the session list available
for configured SKM/ESKM in the cluster. If the DEK retrieval fails, it is retried.
• DEK update: DEK update behavior is the same as DEK creation.