Introduction
Utimaco's Enterprise Secure Key Manager (ESKM) is a most versatile scalable key manager to securely manage encryption keys across the enterprise. The ESKM can use its native protocol (KMS – Key Management Service) or industry-standard OASIS KMIP (Key Management Interoperability Protocol) for its client integrations.
This integration guide concentrates on enabling client-side encryption for HPE StoreOnce and centralized key management to simplify security operations like compliance auditing, centralized key management and policy execution along with enforcement.
This section is not a substitute for HPE StoreOnce documentation. Should this section offer different instructions than StoreOnce's documentation, follow the instructions issued by HPE StoreOnce.
Pre-requisites for Integration
-
You have “admin” access to and are familiar with the ESKM appliance and the HPE StoreOnce procedures, configuration, and protocols.
-
The HPE StoreOnce is configured and functioning.
The examples in this document use ESKM v8.53.0 software and HPE StoreOnce v4500 Backup.
Configuration Overview
The solution presented here integrates HPE StoreOnce with ESKM into a purpose-built system to protect the backup data with the easy and efficient data protection (encryption) capability of HPE StoreOnce and the key management capability of ESKM.
HPE StoreOnce Configuration Overview
To perform the data backup, we have deployed a backup server on HPE Hyper Converged 380 with VMware® vSphere 6.0. However, please note that any backup platform is supported for data protection, provided the backup software installed on it supports integration with HPE StoreOnce.
HPE StoreOnce supports both local and external key management. Keys generated and managed are the Data Encryption Key (DEK), which is used for actual encryption of data on HPE StoreOnce, and the Key Encryption Key (KEK), which is used to encrypt the data encryption key itself. With local key management, the HPE StoreOnce key management system creates, manages, and stores both the data encryption key and the key encryption key. The HPE StoreOnce local keystore manager keeps track of all of the keys used for data encryption. With external key management, HPE StoreOnce is enrolled as a client to an external Enterprise Secure Key Manager.
ESKM creates and manages the key encryption key (KEK) that is used to encrypt the data encryption keys (DEKs) on HPE StoreOnce. There is one key encryption key created per node of HPE StoreOnce on ESKM and this KEK is also known as the “Master Key” which encrypts and decrypts all the data encryption keys belonging to the HPE StoreOnce.
So, both the StoreOnce OS in local key management mode and ESKM in external key management mode manage and store the Key Encryption Key, which is used to wrap (encrypt) the data encryption keys doing the actual encryption of data on HPE StoreOnce.