SECURING FIBRE CHANNEL FABRICS - Brocade

Brocade Encryption Featuresthe DEK has been committed to the key vault and an acknowledgementhas been received from the key vault, the DEK is exchanged withthe other members in the encryption group.When a new LUN, tape media, or LUN with existing cleartext data isencrypted, the Brocade encryption device generates a new DEK. Thiskey is then backed up to the primary key vault, and secondary keyvault if it exists. Once the primary key vault has successfully stored theDEK, it confirms this to the encryption device. The DEK is then synchronizedwith all of the other members in its encryption group, asshown in Figure 47. Only once this has occurred will the new key beused to encrypt actual production data.Redundant Key VaultsKey vaults may also be configured in a clustered configuration to provideredundancy. Each key management solution vendor offersdifferent clustering features and functionality , but all of them providesome form of clustering capability. Although clustering the key vault isan optional feature, it is certainly recommended as a best practice.Ideally, a key vault should be located in at least two physically separatelocations to provide the maximum redundancy in the event of a catastrophethat destroys an entire site.BrocadeencryptiondeviceLANPrimary key vault2. DEK backed up to primary key vault5. DEK synchronizedwith encryptiongroup members4. Primary key vaultconfirms DEK toencryp. deviceGroup leader6. DEK ready to beginencryption to LUNBrocade 1. Brocadeencryption encryption devicedevice generates DEK3. DEK backed up to secondary key vaultSecondary key vaultFigure 7. DEK synchronizationDataFort Compatibility Mode. The NetApp DataFort encryption appliancewas at one point the market leader in the storage encryptionspace. NetApp and Brocade established a strategic relationship to usethe Brocade encryption solution as the next-generation DataFort. Oneof the challenges to making this happen was determining what to dowith existing DataFort customers who have thousands of tapes previouslyencrypted using the DataFort product. The solution was to createSecuring Fibre Channel Fabrics 185