SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 11: Brocade Data Encryption ProductsKey ManagementOnce data is encrypted onto a storage media, the keys become highlycritical and extensive measures must be taken to protect them. Appropriatemeasures should be taken to manage these keys throughout theirlifecycle. Keys need to be backed up as they can be lost, stolen,destroyed intentionally, or expired after a pre-determined period of time.Loss of the encryption keys is equivalent to losing the data. Unlike datain-flight,the keys for data-at-rest must be available for relatively longperiods of time, depending on the type of information being encrypted.With patient health records, for example, it is possible that information iskept for the lifetime of a patient, which can be over 100 years. Keys canalso be stolen or compromised, in which case the information wouldhave to be re-encrypted using a different key to ensure the confidentialityof the information. Media such as disk and tape also have a limitedshelf life and may undergo evolution cycles to an eventually incompatibleformat (remember 8-track tapes and floppy disks?). The informationneeds to be refreshed as the media expires and must be re-encryptedusing the same key (exact replica of tape) or a different key.For redundancy, a typical key vault will be implemented with two ormore units to prevent single points of failure. If the primary key vaultbecomes unavailable, the secondary or other key vault can accept orprovide keys to the encryption device.The following key management solutions are currently supported:• NetApp Lifetime Key Management (LKM)• EMC Data Protection Manager (DPM, formerly RKM)• HP Enterprise Secure Key Manager (ESKM)• Thales Encryption Manager for Storage (formerly TEMS)• IBM TKLM v2• SafeNet e-Security KeySecureBrocade supports the OASIS KMIP (Key Management InteroperabilityProtocol), which has become the industry-accepted key managementinterface standard.Brocade encryption devices generate the actual data encryption keyand store it locally in its cache. The DEK is used to encrypt data usingthe AES-256 encryption algorithm. Before any data encryption begins,the key must be backed up to a key vault, or key manager, and thenplaced in the local cache before it can be used. Subsequently, once184 Securing Fibre Channel Fabrics