HP StorageWorks Secure Key Manager -
Overview & Features

Overview

What would happen if your backup tapes and disposed disk drives were lost or stolen? When data at rest encryption keys are secure, the threats of financial loss and damage to your company's reputation are significantly lowered.

The The HP StorageWorks Secure Key Manager reduces your risk of a costly data breach and reputation damage while improving regulatory compliance with a secure centralized encryption key management solution for HP LTO-4 enterprise tape libraries and Encryption SAN Switches. The Secure Key Manager automates key management and is a hardened server appliance delivering secure identity-based access, administration and logging with strong auditable security meeting the rigorous FIPS 140-2 security validation. Additionally, the Secure Key Manager provides reliable lifetime key archival with automatic multi-site key replication, and high availability clustering. Encryption clients may access the cluster using flexible path and node failover capabilities.

What's new

• Increased capacity from 100,000 to 2,000,000 encryption keys per cluster. This allows Secure Key Manager to keep more data private for longer periods of time without running out of space.
• Lowered entry price with a single client license/node configuration.
• Consolidated to a single hardware SKU for ordering simplicity.
• Supports HP Encryption SAN Switch.

Features & benefits

• Reduce risk of a data breach: Keep your tape and disk encrypted data private and protect your company reputation with HP Secure Key Manager while improving regulatory compliance and avoiding financial consequences of a breach. Avoid situations requiring disclosure of unauthorized access to unencrypted private information.
• Centralized automatic policy-based key generation: Reduces the complexity of managing encryption keys for data at rest across a distributed infrastructure with a single point of management. Independent of tape drive count, multiple ESL/EML LTO-4 tape libraries are supported per node further boosting investment protection.
• Transparent to ISV applications: Reduce impact to existing backup and recovery processes. The key management and data encryption occurs transparent to the backup application. The data can be decrypted on an HP Secure Key Manager library client that has permission to access the key.
• Extensible to emerging open standards: The HP Secure Key Manager architecture and plans support future encryption clients beyond HP ESL and EML Tape Libraries. It is the platform HP is using to build infrastructure-wide centralized key management for information protection across the enterprise.

• Security hardened server appliance: Features a security hardened Linux kernel, dual locking bezel with durable pick-resistant locks and tamper-evident enclosure seals to provide platform security substantially beyond a general purpose server key repository.
• Secure access, control and digitally signed logs: Provides a trusted infrastructure for enforcement of internal security policies/controls and a trusted audit trail of encryption and key management activities as evidence for compliance and audit verifications.
• FIPS 140-2 Level 2 validated : The HP Secure Key Manager is appropriate for stringent cryptographic installations and supports AES-256 key generation. FIPS 140-2 Level 2 re-validation is pending and based on SKM1.0 validation certificate #1102.

• Automatic multi-site key replication: High availability and reliability are paramount because keys must be retained for the life of the data which may be for decades. The HP Secure Key Manager delivers high availability of archived keys for same or multi-site coverage. Key replication occurs automatically in a cluster.
  
• Comprehensive key backup and restore functionality: The HP Secure Key Manager can generate additional copies of the keys, policies, certificates and configuration to an encrypted file.
• Redundant device components and active alerts: For improved overall reliability the HP Secure Key Manager has redundant dual fans, power supplies and disk drives (RAID 1 mirroring) along with active alerts and health checks to maintain uptime.