HP StorageWorks Secure Key Manager -
Overview & Features

Overview

What would happen if your backup tapes and removable media were lost or stolen? When data at rest encryption keys are secure, the threats of financial loss and damage to your company’s reputation are significantly lowered.

The HP StorageWorks Secure Key Manager reduces your risk of a costly data breach and reputation damage while improving regulatory compliance with a secure centralized encryption key management solution for HP LTO-4 enterprise tape libraries. The Secure Key Manager automates key generation and management based on security policies. This occurs transparent to ISV backup applications. The Secure Key Manager is a hardened server appliance delivering secure identity-based access, administration and logging with strong auditable security designed to meet the rigorous FIPS 140-2 security standards. Additionally, Secure Key Manager provides reliable lifetime key archival with automatic multi-site key replication, high-availability clustering and failover capabilities.

What's new

• Increased capacity from 100,000 to 2,000,000 encryption keys per cluster. This allows Secure Key Manager to keep more data private for longer periods of time without running out of space.
• Lowered entry price with a single client license/node configuration.
• Consolidated to a single hardware SKU for ordering simplicity.

Features & benefits

• Reduce risk of a data breach: Keep your tape-encrypted data private and protect your company reputation with HP Secure Key Manager while improving regulatory compliance and avoiding financial consequences of a breach. Avoid situations requiring disclosure of unauthorized access to unencrypted private information.
• Centralized automatic policy-based key generation: Reduces the complexity of managing encryption keys across a distributed infrastructure with a single point of management. Independent of tape drive count, multiple ESL/EML LTO-4 tape libraries are supported per node further boosting investment protection. Only network connectivity is required.
• Transparent to ISV applications: Reduce impact to existing backup and recovery processes. The key management and data encryption occurs transparent to the backup application. The data can be decrypted on an HP Secure Key Manager library client that has permission to access the key.
• Extensible to emerging open standards: The HP Secure Key Manager architecture and plans support future encryption clients beyond HP ESL and EML Tape Libraries. It is the platform HP is using to build infrastructure-wide centralized key management for information protection across the enterprise.

• Security hardened server appliance: Features a security hardened Linux kernel, dual locking bezel with durable pick-resistant locks and tamper-evident enclosure seals to provide platform security substantially beyond a general purpose server key repository.
• Secure access, control and digitally signed logs: Provides a trusted infrastructure for enforcement of internal security policies/controls and a trusted audit trail of encryption and key management activities as evidence for compliance and audit verifications.
• FIPS 140-2 Level 2 security re-validation pending: The HP Secure Key Manager is appropriate for stringent cryptographic installations and supports AES-256 key generation. FIPS 140-2 Level 2 re-validation is pending and based on SKM1.0 validation certificate #999.

• Automatic multi-site key replication and failover: High availability and reliability are paramount because keys must be retained for the life of the data, which may be for decades. The HP Secure Key Manager delivers high availability of archived keys for same or multi-site coverage. Key replication and failover occurs automatically in a cluster.
  
• Comprehensive key backup and restore functionality: The HP Secure Key Manager can generate additional copies of the keys, policies, certificates and configuration to an encrypted file.
• Redundant device components and active alerts: For improved overall reliability the HP Secure Key Manager has redundant dual fans, power supplies and disk drives (RAID 1 mirroring) along with active alerts and health checks to maintain uptime.