When using external key manager mode, StoreOnce is enrolled to an external key manager as a client. After successful enrollment, the key encryption key (KEK) used for encrypting data encryption keys (DEKs) on StoreOnce is generated, served, stored, and managed by the external key manager. One KEK is generated as a KMIP key on ESKM for one node of HPE StoreOnce, and it is used to encrypt and decrypt all the DEKs on that particular node of HPE StoreOnce.
Enrolling HPE StoreOnce to ESKM is based on secure identity-based access, administration, and logging, and HPE StoreOnce leverages the standard Key Management Interoperability Protocol (KMIP) for accessing and communicating with the external key manager.
Centralized key management
When enrolling StoreOnce to ESKM, if there are any target stores on StoreOnce using local key management mode, StoreOnce does a backup of the keystore for these existing LKM stores before enrolling StoreOnce to ESKM.
The HPE StoreOnce can be configured to use only the local key manager or the external key manager. Both key manager types cannot be used at the same time.
After successful enrollment of HPE StoreOnce to ESKM, one KMIP key is created per node of HPE StoreOnce. This KMIP key is the key encryption key (KEK) that is used to encrypt the data encryption keys (DEKs) on HPE StoreOnce. Typically, one key is generated per service set running on HPE StoreOnce and since each StoreOnce node has one service set running on a regular basis, one key is generated per node of StoreOnce on ESKM.
Key and Policy Configuration