IBM DS8700, Introduction And Planning Manual

Page: 106 / 256

3. You configure the key servers to be used with the DS8000. IBM Lab Services
or IBM Global Services can be contracted to assist with the setup of the key
servers.
4.
You configure the Tivoli Key Lifecycle Manager to add the DS8000 SFIs to the
device table and configure a key label for the DS8000 SFIs.
5. You configure the DS8000 with the IP addresses of the associated key server
ports.
6. Before you configure an encryption group, configure a recovery key either
configure a recovery key or disable it. You configure an encryption group on
the DS8000 SFIs with a key-label defined on the Tivoli Key Lifecycle Manager.
7.
You request encryption certification for the DS8000 SFIs. Encryption
certification consists of one of the following scenarios:
v You contract IBM Lab Services to provide education and to validate the
configuration of key servers that are configured with the DS8000. At the
completion of the validation, IBM Lab Services provides you with an
agreement that requires your signature and returns the signed agreement to
IBM.
v
You notify the IBM sales team that they are ready to activate encryption on
the DS8000 SFI. The IBM sales team provides you with an agreement that
requires your signature and returns the signed agreement to IBM.
8. IBM files your agreement and authorizes a LIC authorization key to activate
encryption on the SFI. Each LIC authorization key is unique to the SFI for
which it is generated.
9. You install the LIC authorization key on the SFI.
10.
You can now configure ranks or extent pools for the configured encryption
group.
Notes:
a. All ranks and extent pools on a given encryption-capable DS8000
SFI must be configured with the same encryption group attribute.
The first rank or encryption group that is configured determines
what the remaining objects must be configured with. A value of 0
indicates encryption-disabled. A value of 1 indicates encryption
enabled. The value 0 can only be specified when there are no
encryption groups configured. The value 1 can only be specified
when encryption group 1 is configured.
b. To change between encryption-enabled and encryption-disabled, all
ranks and extent pools must be deconfigured. Deconfiguring an
encryption-enabled rank causes any data that is stored on the rank
to be cryptographically erased and then overwritten to reinitialize
the rank. Additionally, if encryption is to be enabled, encryption
group 1 must be configured. If encryption is to be disabled,
encryption group 1 must be deconfigured.
11. When a system is discontinued, you must request IBM to perform a box
discontinue action. The IBM service representative then disables encryption on
all SFIs on the storage facility by installing a disablement authorization key for
encryption. Later use of the system requires the procedure to enable
encryption to be performed again. If this process is not performed, you
assume responsibility for any liability for any misuse of the box by any future
owners.
84
Introduction and Planning Guide