Encryption Key Management

Explore this Page

Overview

This page describes the methods available for managing encryption keys used by the Data-at-Rest Encryption feature in DataCore SANsymphony. Encryption keys can be managed locally using the Data-at-Rest Pool Key tool (DcsPoolKeyCli) or externally through Key Management Servers (KMS) using the Key Management Interoperability Protocol (KMIP). These options provide flexibility for exporting, importing, and protecting encryption keys, as well as integrating with centralized key management solutions.

Managing Pool Encryption Keys with DcsPoolKeyCli

The Data-at-Rest Pool Key tool (DcsPoolKeyCli) allows you to export, import, and delete keys, as well as list all available pool encryption keys used for the Data-at-Rest Encryption feature.

For one pool encryption key, there is a corresponding RSA key which is used to encrypt/decrypt the pool. The pool encryption key is stored in the registry under SOFTWARE\DataCore\SANsymphony\PoolKeys, encrypted, and the key used for decrypting it is stored in the Microsoft Software Key Storage Provider.

The tool supports the following commands:

Command Procedure
List All Available Key Pairs

Use the -l command.

PS C:\> .\DcsPoolKeyCli.exe -l

Export

Use the -e command, and pass the pool ID. The tool will determine if there is a persisted pool encryption key in the registry and also retrieve the RSA key from the Microsoft Software Key Storage Provider. Then it will export the plain (decrypted) key to a passed file or to a default one if not provided.

PS C:\> .\DcsPoolKeyCli.exe -e -p:"pool_id"(required) -f:"filename.bin"(optional)

Include the curly brackets for the pool_id parameter. For example:

PS C:\> \DcsPoolKeyCli.exe -e -p: "{12345678- 1234 -1234 -1234 -123456789012}" -f:"key.bin"

Import

Use the -i command, and pass the pool ID and the full path of the file containing the plain (decrypted) pool encryption key that you want to import. It will be persisted in the registry and a corresponding RSA key will be created and stored.

PS C:\> .\DcsPoolKeyCli.exe -i -p:"pool_id"(required) -f:"fullpath.bin"(required)

Delete

Use the -d command, and pass the pool ID. If if there is an existing pool encryption key, it will be deleted, as well as its corresponding RSA key.

PS C:\> .\DcsPoolKeyCli.exe -d -p:"pool_id"(required)

Understand the risk of using this command before using it as it will permanently delete the key. Back up (export) the key before running this command.

 

When running the DcsPoolKeyCli.exe, always use the PowerShell console or Windows command prompt as an administrator.

Retrieving the Pool ID

To retrieve the pool ID:

  1. Open the DataCore Cmdlets.
  2. Run "Connect-DcsServer"
  3. Run "Get-DcsPool -Pool <PoolName>"
  4. The pool ID will be the value after the colon, enclosed in curly brackets. For example, {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

Key Management Servers (KMIP)

DataCore SANsymphony supports the use of key management servers (KMS), using Key Management Interoperability Protocol (KMIP). In turn, KMIP utilizes Transport Layer Security (TSL) and certificates to set up a Secure Socket Layer (SSL) connection for communication between DataCore Servers and a key management server.

By default, the key management server configuration will be applied to all DataCore Servers in the same server group.

Requirements

Connecting to a key management server requires the following:

  • IP address of the key management server
  • User name and password for account with appropriate access to acquire certificates to be used by KMIP. The password for the user account will be encrypted before being saved in DataCore SANsymphony.

Enabling Key Management

You can configure the key management servers for DataCore SANsymphony in two ways:

  • DataCore SANsymphony PowerShell Cmdlets: See Set-DcsKMIPEndpointProperties in the DataCore Cmdlet Reference Guide.
  • DataCore Management Console: On the Server Group Setting tab, expand, under Encryption Key Management, select the KMIP key management check box. ; once selected the remaining fields become active. The Test Address button will test the connection from each DataCore Server to the configured KMS server.

To configure a key management server from the Server Group Details page:

  1. Click the Server Group Setting tab and expand the Encryption Key Management section.

  2. Select the KMIP key management check box.
  3. In the KMS server address field, enter the IP address for the key management server.

    Use the Test Address button to test the connection from each DataCore Server to the configured key management server.

  4. In the User name and Password fields, enter the credentials for the account to be used by KMIP.
  5. Click Apply to save your changes.

Learn More