GLYPH<SM590000> USB flash drives are not left inserted into the system except as required 

For the most secure operation, do not keep the USB flash drives inserted into the nodes on the system. However, this method requires that you manually insert the USB flash drives that contain copies of the encryption key in the nodes during operations that the system requires an encryption key to be present. 

USB flash drives that contain the keys must be stored securely to prevent theft or loss. During operations that the system requires an encryption key to be present, the USB flash drives must be inserted manually into each node so data can be accessed. After the system completes unlocking the drives, the USB flash drives must be removed and stored securely to prevent theft or loss. 

## 4.6.4 Encryption at rest with key servers 

The following section describes the characteristics of using key servers for encryption and essential advice for key server configuration with IBM Spectrum Virtualize and Storwize. 

## Key servers 

Key servers have the following characteristics: 

GLYPH<SM590000> Physical access to the system is not required to process a rekeying operation 

GLYPH<SM590000> Support for businesses that have security requirements not to use USB ports 

GLYPH<SM590000> Strong key generation 

GLYPH<SM590000> Key self-replication and automatic backups 

GLYPH<SM590000> Implementations follow an open standard that aids in interoperability 

GLYPH<SM590000> Audit detail 

GLYPH<SM590000> Ability to administer access to data separately from storage devices 

Encryption key servers create and manage encryption keys that are used by the system. In environments with a large number of systems, key servers distribute keys remotely without requiring physical access to the systems. 

A key server is a centralized system that generates, stores, and sends encryption keys to the system. If the key server provider supports replication of keys among multiple key servers, you can specify up to 4 key servers (one master and three clones) that connect to the system over both a public network or a separate private network. 

The system supports enabling encryption using an IBM Security Key Lifecycle Manager key server. All key servers must be configured on the IBM Security Key Lifecycle Manager before defining the key servers in the management GUI. IBM Security Key Lifecycle Manager supports Key Management Interoperability Protocol (KMIP), which is a standard for encryption of stored data and management of cryptographic keys. 

IBM Security Key Lifecycle Manager can be used to create managed keys for the system and provide access to these keys through a certificate. If you are configuring multiple key servers, use IBM Security Key Lifecycle Manager 2.6.0.2 or later. The additional key servers (clones) support more paths when delivering keys to the system; however, during rekeying only the path to the primary key server is used. When the system is reeked, secondary key servers are unavailable until the primary has replicated the new keys to these secondary key servers. 

Replication must complete before keys can be used on the system. You can either schedule automatic replication or complete it manually with IBM Security Key Lifecycle Manager. During replication, key servers are not available to distribute keys or accept new keys. The time a replication completes on the IBM Security Key Lifecycle Manager depends on the number of key servers that are configured as clones and the amount of key and certificate information that is being replicated. 

