IBM DS8700, Introduction And Planning Manual

Page: 99 / 256

The security administrator receives a 256-bit key that is generated from the SFI
during the configuration process and must securely maintain it for future use if an
encryption deadlock occurs. The SFI does not maintain a copy of the recovery key.
The storage administrator must then approve the recovery key configuration
request for it to become active. During the configuration process, the following
steps take place:
1. The security administrator initiates the configure recovery key function.
2. The SFI generates a recovery key and generates a secure hash of the recovery
key producing the recovery key signature.
3. The SFI generates a random key pair (the private key is referred to as the
primary recovery key and the public key is referred to as the secondary
recovery key).
4.
The SFI stores the encrypted primary recovery key, secondary recovery key, and
recovery key signature for future use. The encrypted primary recovery key and
secondary recovery key are stored in multiple places for reliability.
5. The SFI provides the recovery key to the security administrator.
6. The SFI sets the primary recovery key and recovery key to zero, puts the
recovery key in the verify-pending state, and completes the configure recovery
key function successfully.
7. The security administrator initiates the verify recovery key function and inputs
the recovery key.
8. The storage administrator initiates the authorize recovery key function.
9.
The storage facility image puts the recovery key in the configured state and
completes the authorize recovery key function successfully.
Within a secure key environment, you might choose to disable the recovery key
rather than to configure one. While disabling the recovery key increases the
security of the encrypted data in the DS8000, it also increases the risk of encryption
deadlock, described under “Encryption deadlock” on page 78.
If you choose to disable the recovery key, you are highly encouraged to strictly
follow the guidelines included in “Encryption deadlock prevention” on page 80.
Failure to do so might result in permanent loss of all your encrypted data
managed by key servers, if an encryption deadlock occurs.
The state of the recovery key must be "Unconfigured" to disable the recovery key.
The following includes the process of the recovery key:
1.
The security administrator requests that the recovery key be disabled. This
action changes the recovery key state from "Unconfigured" to "Disable
Authorize Pending."
2. The storage administrator authorizes the recovery key disablement. This action
changes the recovery key state from "Disable Authorize Pending" to "Disabled."
Each encryption group configured has its own recovery key that might be
configured or disabled. The current DS8000 implementation supports a single
encryption group and a single recovery key.
It is possible to re-enable the recovery key of an encryption group once the
encryption group is in the unconfigured state. This action implies a prerequisite
break down of encrypted volumes, ranks, and extent pools. The following includes
the process of enabling the recovery key:
1.
The security administrator requests that the recovery key be enabled. This
action changes the recovery key state from "Disabled" to "Enable Authorize
Pending."
Chapter 3. Data management features
77