Cisco MDS 9000 Family Storage Media Encryption Configuration Guide - Release 4.x (OL-18091-01, February 2009)

Send documentation comments to [e-mail]
6-2
Cisco MDS 9000 Family Storage Media Encryption Configuration Guide
OL-18091-01, Cisco MDS NX-OS Release 4.x
Chapter 6 Cisco SME Key Management
Cisco Key Management Center
Master Key
When a Cisco SME cluster is created, a security engine generates the master key. Considering that a
single fabric can host more than one cluster, for example, to support the needs of multiple business
groups within the same organization, there will be as many master keys as there are clusters. Each master
key is unique and it is shared across all cluster members. The master key is used to wrap the tape volume
group keys.
Tape Volume Group Key
The tape volume group key is used to encrypt and authenticate the tape volume keys which are the keys
that encrypt all tapes belonging to the same tape volume group. A tape volume group can be created on
the basis of a bar code range for a set of backup tapes or it can be associated with a specific backup
application. Tape volume group keys are occasionally rekeyed for increased security or when the
security of the key has been compromised.
Tape Volume Key
The tape volume key is used to encrypt and authenticate the data on the tapes.
In unique key mode, the tape volume keys are unique for each physical tape and they can be stored in
the Cisco KMC or stored on the tape. The Cisco KMC database does not need to store a tape volume key
if the key is stored on the tape itself. The option to store the key on the tape may dramatically reduce the
number of keys stored on the Cisco KMC.
In shared key mode, there is one tape volume key which is used to encrypt all volumes in a volume group.
Cisco Key Management Center
The Key Management Center (Cisco KMC) is the centralized management system that stores the key
database for active and archived keys. The keys stored in the Cisco KMC are not usable without the
master key. To manage the potential increase in tape volume keys, Cisco SME provides the option to
store the tape volume key on the tape itself. In this case, the Cisco KMC stores the tape volume group
keys.
This option exponentially increases the number of managed tapes by reducing the number of keys stored
on the Cisco KMC. However, this option also restricts the capability of purging keys at a later time.
The Cisco KMC provides the following advantages:
• Centralized key management to archive, purge, recover, and distribute tape keys
• Integrated into Fabric Manager Server depending on the deployment requirements.
• Integrated access controls using AAA mechanisms.
Note The Cisco KMC listens for key updates and retrieves requests from switches on a TCP port. The default
port is 8800; however, the port number can be modified in the smeserver.properties file.