SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 5: Elementary CryptographyBrocade Encryption DeviceKey Vault256-bit key encryption keynot shared with key vaultWrappeddata encryptionkeyEncrypted keys are storedin the key vault database beforeany data can be encryptedEncryptionengineSecure linkCleartextdataencryptionkeyFIPS 140-2 Layer 3 Security boundarydefines where keys must be wrapped(encrypted) before they leaveFigure 8. Opaque key exchangeChapter SummaryCryptography has been used for centuries and has evolved considerablywith the arrival of computers and high technology. Thedevelopment of networks and the Internet made it critical to developnew methods to exchange information securely across these newmedia—and the SAN is no exception. There are several vulnerabilitiesin a SAN environment that must be addressed using cryptography,such as the secure exchange of data across data centers, betweenswitches and their management servers, or to ensure confidentiality ofdata-at-rest on disk or tape media.Many of the technologies commonly used in conventional TCP/IPbasednetworks can also be used in SAN environments, particularlywhen protecting the management interfaces. Specific solutions existto address requirements unique to SAN environments, such asauthenticating devices joining a fabric using DH-CHAP.90 Securing Fibre Channel Fabrics