IBM DS8700, Introduction And Planning Manual

Page: 97 / 256

The DS8800 allows the installation of the following encrypted SAS drives with key
management services supported by Tivoli Key Lifecycle Manager (TKLM) software:
v
450 GB 10,000 RPM
v 600 GB 10,000 RPM
v
900 GB 10K RPM
v 3 TB 7.2K RPM
The IBM Full Disk Encryption disk drive sets are optional to the DS8000 series.
Encryption drive set support must be ordered using feature number 1751.
For the DS8700, enterprise-class disks are available in 300 GB or 450 GB capacities
and with 15K RPM speed. These drives contain encryption hardware and can
perform symmetric encryption and decryption of data at full disk speed with no
impact on performance.
To use data encryption, a DS8000 must be ordered from the factory with all IBM
Full Disk Encryption drives. At this time, DS8000 does not support intermix of
FDE and non-FDE drives so additional drives added to a DS8000 must be
consistent with the drives that are already installed. DS8000 systems with IBM Full
Disk Encryption drives are referred to as being encryption-capable. Each storage
facility image (SFI) on an
encryption-capable DS8000 can be configured to either
enable or disable encryption for all data that is stored on your disks. To enable
encryption, the DS8000 must be configured to communicate with two or more
Tivoli Key Lifecycle Manager key servers. The physical connection between the
DS8000 HMC and the key server is through a TCP/IP network.
Each IBM Full Disk Encryption drive has an encryption key for the region of the
disk that contains data. When the data region is locked, the encryption key for the
region is wrapped with an access credential and stored on the disk media. Read
and write access to the data on a locked region is blocked following a power loss
until the initiator that is accessing the drive authenticates with the currently active
access credential. When the data region is unlocked, the encryption key for the
region is wrapped with the unique data key that is assigned to this particular disk
and stored on the disk media. This data key is accessible to the device and to any
initiator that is attached. The data key is visible on any external device labeling.
Read and write access to the data on an unlocked region does not require an
access credential or any interface protocols that are not used on a non-IBM Full
Disk Encryption drive. IBM Full Disk Encryption drives still encrypt and decrypt
data with an encryption key. However, the encryption and decryption is done
transparently to the initiator.
For DS8000, the IBM Full Disk Encryption drive that is a member of an
encryption-enabled rank is locked. An IBM Full Disk Encryption drive that is not
assigned, a spare, or a member of an encryption-disabled rank is unlocked.
Locking occurs when an IBM Full Disk Encryption drive is added to an
encryption-enabled rank. Unlocking occurs when an encryption-enabled rank is
deleted or when an encryption-enabled rank member becomes a spare. Unlocking
implies a cryptographic erasure of an IBM Full Disk Encryption drive. IBM Full
Disk Encryption drives are also cryptographically erased when an
encryption-disabled rank is deleted. You can cryptographically erase data for a set
of logical volumes in an encryption-capable extent pool by deleting all of the ranks
that are associated with the extent pool.
Chapter 3. Data management features
75