Enterprise Key Management with OASIS KMIP RSA Conference 2018

What does KMIP do? Key Material & Metadata Transport Security Applications or Appliances KMIP Key Management Server Create, Register, Locate and Retrieve Encryption Keys & Security Objects Supports Symmetric Keys, Asymmetric Keys, Certificates, etc. Much more than just add, modify & delete Many extended services: Encrypt, Decrypt, Signing, Split-Keys etc. Rich metadata for essential cryptographic management The KMIP specification includes an incredibly broad range of capabilities for full lifecycle management of security objects, with almost unlimited extensibility through a flexible, yet interoperable attribute model. 46 Operations (much more than just add, modify & delete) enables Security Appliances/Applications to perform tasks including: Encryption, Decryption, Authentication, Certification, Signing, Verification and Split-Key operations. 9 Object types catering for many more security objects include: Certificate, Certificate Request, Opaque Object, PGP Key, Private Key, Public Key, Secret Data, Split Key, Symmetric Key 54 Attributes to represent information (meta-data) about each Object under management

KMIP 2018 RSA Interop Demonstration Over the last month implementations from these vendors have undergone a rigorous Interoperability testing process to prove the latest additions to the KMIP Specification and deliver true multi vendor interoperability. It is this rigor that ensures conformant implementations meet the aims of the KMIP Technical Committee and the expectations of the market If you have not already seen a demonstration from at least one of these members, please ask for a demonstration at the conclusion of this presentation.

KMIP RSA 2018 Test Results 9 KMIP TC members 17 implementations 8 Client Implementations 9 KMIP Technical Committee members testing 17 implementations 8 Client Implementations 9 Server Implementations Over 33,000 successful test runs 72 Test combinations across 4 encodings 9 Server Implementations Over 33,000 successful test runs 72 Test combinations 4 encodings

KMIP Deployed in Solutions KMIP solutions are deployed across in all industry sectors, delivering management of security objects for: Cloud Storage Identity Management Financial systems Automotive Healthcare Email Provisioning and supply chain PKI Communications Authentication Defense

KMIP Deployed by Organizations Many organizations are relying on KMIP to ensure management and visibility of their security object It remains the default standard for full lifecycle security object management

KMIP Specification Development Enterprise Requirements Specification Development Being part of the OASIS KMIP TC enables vendors to more quickly bring their customers’ requirements to the standards development process. The enterprise requirements drive the Specification development which Drives the Product Testing which is fed back into the enterprise Product Deployment Specification Testing

KMIP and HP  HPE  Micro Focus Originator and supporter of KMIP development since 2009 One of 4 founders authoring the original draft 0.1 spec 8 years participation in the annual OASIS KMIP interop Implemented KMIP across entire HPE Storage portfolio Largest enterprise deployments of KMIP clients/servers

Micro Focus Security Enterprise Secure Key Manager Key management for enterprise servers, storage, apps Atalla AT1000 Payments HSM FIPS Level 3, highest PIN processing performance Voltage ArcSight Fortify NetIQ

Enterprise Secure Key Manager High-assurance key protection for encryption applications OASIS KMIP Server Centrally manage enterprise keys Reliably separate keys from data Automate and simplify operations Integrates large IT ecosystems Full range of storage, server and software clients KMIP standard qualified partners Features at a Glance Trusted: FIPS 140-2 validated and CC certified Reliable: 1U redundant hardware Available: active-active 8-node clustering Scalable: largest enterprise and geographic deployments Interoperable: industry-standard KMIP versions 1.0 – 1.4, 2.0

Security & business continuity with market-leading interoperability Enterprise Secure Key Manager Security & business continuity with market-leading interoperability HPE ProLiant Servers with built in Secure Encryption HPE StoreOnce Backup HPE 3PAR StoreServ (Disk and All-Flash Array) HPE StoreEver Tape Libraries Enterprise Secure Key Manager Partner SDKs KMIP Clients HPE XP7 High End Storage x8 Connected MX Openstack Barbican BackBox Virtual tape NonStop Servers

OASIS KMIP standard: Open interoperability for partners ESKM leads in compliance for application interoperability StoreSafe virtual appliance Network proxy-based solution BACKBOX for NonStop Virtual Tape Controller Storage solutions Filer Systems (NSE Appliances) SDKs Enterprise Secure Key Manager x 8 SDKs VSP and HUS High-end storage systems VM Encryption and vSan Data at Rest Encryption Openstack Barbican Big Data / NoSQL Encryption Database

ESKM KMIP Partner Program Open to all vendors/organizations supporting KMIP ESKM KMIP test server access, joint solution qualification No other costs or fees Benefits Mutual interoperability certification and support Customer integration/installation guide Joint co-branded solution brief Ongoing new release test access