IBM DS8700, Introduction And Planning Manual

Page: 105 / 256

– The ability of each key server to unwrap data keys that are
configured on the DS8000 is verified at 8 hour intervals. Loss of the
ability unwrap a configured data key is reported to both you and
IBM.
– The DS8000 detects if there are fewer than two key servers
configured, or fewer than two key servers that are available, or there
are fewer than two key servers that can unwrap data keys configured
on the DS8000 at 8 hour intervals. If detected, this condition is
reported to both you and IBM.
Tape Related
Validate keystore backups to assure they are not being encrypted.
Validation can be performed by reading the backup through a storage
device that has been confirmed as being not encryption capable or as
having no access to a key manager.
Encrypted storage installation guidelines
For a successful installation, ensure that you understand and follow the guidelines
for installing encryption-capable storage devices.
The following guidelines apply:
v You must have an isolated key server that meets the following hardware and
software requirements:
– IBM System L5420 with the following specifications:
- Quad-core Intel Xeon Processor X5420 2.5 GHz / 12 MB L2 / 1.0 GHz FSB
/ 50 W
- 6 GB memory
- 146 GB SAS RAID 1 Storage
- Dual gigabit Ethernet ports
- SUSE Linux 9.0 (32 bit)
- Power supply
– Tivoli Key Lifecycle Manager that includes DB2 9.1 FB4
Important: The hardware is the same as that is used for the Tivoli Storage
Productivity Center . However, a different software load has been
installed by manufacturing. No other hardware or software is
allowed on this server. An isolated server must only use internal
disk for all files necessary to start and have the Tivoli Key Lifecycle
Manager key server operational.
v
You must have at least one isolated key server per site. This key server can be
configured to serve keys to any Tivoli Key Lifecycle Manager supported device,
including IBM tape.
v You must configure at least one isolated key server to each DS8000 that is
encryption enabled.
v
You must configure at least two key servers to each DS8000 that is encryption
enabled.
v
To use encryption on a DS8000, you must be certified for using encryption on
each DS8000 storage facility image (SFI). After you are certified, IBM enables the
encryption function on the SFI.
The ordering, installation, and encryption activation of an encryption-capable
DS8000 involves the following steps:
1. You order a DS8000 from IBM with encryption-capable DDMs.
2. IBM delivers the DS8000 and the IBM service representative installs the
DS8000.
Chapter 3. Data management features
83