IBM DS8700, Introduction And Planning Manual

Page: 103 / 256

LPARs, do not use data sharing techniques that result in one copy of the
data being shared by multiple instances of the key server.
v
Configure two or more key servers to have a dedicated server and
dedicated non-encrypted storage resources. This requirement physically
localizes and isolates the key server environment to a set of hardware
components with known lack of dependency on a key server such that
the potential for migrating the key server data outside of the
environment becomes negligible with appropriate controls and
processes. These key servers are referred to as
isolated key servers . The
DS8000 requires at least one isolated key server be configured, but you
must have two for redundancy.
v
You can configure additional key servers on generalized server hardware
and generalized storage. However, appropriate procedures and controls
must be established to prevent these key servers from having their data
access compromised by storing the data on key server managed
encrypting storage. These key servers are referred to as
general key
servers .
v Configure key servers at independent sites to provide additional
immunity to encryption deadlocks because it reduces the probability for
all key servers to experience a simultaneous power loss.
v
The utilization of uninterruptible power supply units on certain key
servers can provide additional immunity to an encryption deadlock.
v
The initiation of a Tivoli Key Lifecycle Manager key server involves the
specification of a password that is used to access the keystore. Ensure
appropriate retention of the password and limit access to the password
to appropriate personnel. Loss of a password is a cryptographic erasure
of the keystore for the associated key servers. Loss of one or more
redundant key servers increase the probability of an encryption
deadlock. The permanent loss of all encryption key servers is equivalent
to a permanent encryption deadlock.
v You must ensure that all key servers that a storage device is configured
to and communicate with have consistent keystore content relative to
any wrapping keys that are to be used by the storage device. Any
wrapping keys to be used on any key server must be propagated across
the set of key servers that are associated with a storage device before the
storage device is configured to use those wrapping keys. Failure to
synchronize the keystores effectively eliminates one or more key servers
from the set of redundant key servers for a device that uses the keys
that are not synchronized.
v Backup key server data after it is updated. The backups must not be
stored on encrypted storage media that is dependent on a key server.
v
Periodically audit all online and backup data that is required to make
each key server operational to ensure that it is stored on storage or
media that is not dependent on a key server to access the data.
v Do not delete keys on the key server under normal circumstances. The
appropriate action to remove a key from a key server is almost always
to archive the key. If the wrong key is inadvertently archived causing the
loss of access to encrypted data at some point in the future, the archive
action allows the key to be restored. Deletion of all copies of a key is a
cryptographic erase of all encrypted data that is encrypted under this
key.
DS8000
Chapter 3. Data management features
81