The configuration workflow depends on the encryption method.
Workflow for Data at Rest Encryption
Using the Encryption License Key, you can encrypt data stored on volumes in a storage system. Encrypting data helps to prevent information leaks.
When the storage system is not linked to a key management server
| Task | VSP One Block Administrator | Management tool |
|---|---|---|
| Install the license | ✓ | |
| Set the encryption environmental settings | ✓ | |
| Check the encryption environmental settings/encryption keys | ✓ | |
| (Optional) Back up the encryption keys | ✓ | |
| Create an encrypted pool | ✓ |
When the storage system is linked to a key management server
| Task | VSP One Block Administrator | Management tool |
|---|---|---|
| Install the license | ✓ | |
| Import a certificate for the key management server connection | ✓ | |
| Check the certificates for the key management server connection | ✓ | |
| Set the key management server settings | ✓ | |
| Check the key management server settings | ✓ | |
| Set the encryption environmental settings | ✓ | |
| Check the encryption environmental settings/encryption keys | ✓ | |
| Perform connection test | ✓ | |
| Configure key management server priority | ✓ | |
| (Optional)Back up the encryption keys | ✓ | |
| Create an encrypted pool | ✓ |
Workflow for Data Inflight Encryption
Using data inflight encryption, you can encrypt communication between the storage system and hosts. Encrypting data inflight helps protect sensitive data from interception during transmission.
To use this encryption, configure the Key Management Server and enable port security.
When the storage system is linked to a Key Management Server
| Task | VSP One Block Administrator | Management tool/CCI |
|---|---|---|
| Install license | ✓ | |
| Import a certificate for the key management server connection | ✓ | |
| Check the certificates for the key management server connection | ✓ | |
| Set the key management server settings | ✓ | |
| Check the key management server settings | ✓ | |
| Perform connection test | ✓ | |
| Configure key management server priority | ✓ | |
| Enable the encryption (port security) | ✓ CCI | |
| Verify encrypted communication | ✓ |
Verification of data inflight encryption is performed indirectly by confirming successful host communication and by checking system logs or monitoring information. There is no dedicated GUI indicator for this encryption enablement.
For details about the verification of encrypted communication and enabling port security, see Provisioning Guide for Mainframe Systems
For details about the Encryption License Key function and troubleshooting, see the Encryption License Key User Guide.