Enabling Encryption for Data at Rest 11/11/2018 Enabling Encryption for Data at Rest IBM Security Key Lifecycle manager

11/11/2018 What does KMIP do? Key Material & Metadata Transport Security Applications or Appliances KMIP Key Management Server Create, Register, Locate and Retrieve Encryption Keys & Security Objects Supports Symmetric Keys, Asymmetric Keys, Certificates, etc. Much more than just add, modify & delete Many extended services: Encrypt, Decrypt, Signing, Split-Keys etc. Rich metadata for essential cryptographic management s

KMIP 2018 RSA Interop Demonstration 11/11/2018 KMIP 2018 RSA Interop Demonstration

KMIP RSA 2018 Test Results 9 KMIP TC members 17 implementations 11/11/2018 KMIP RSA 2018 Test Results 9 KMIP TC members 17 implementations 8 Client Implementations 9 Server Implementations Over 33,000 successful test runs 72 Test combinations 4 encodings

KMIP Deployed in Solutions 11/11/2018 KMIP Deployed in Solutions

KMIP Deployed by Organizations 11/11/2018 KMIP Deployed by Organizations

KMIP Specification Development 11/11/2018 KMIP Specification Development Enterprise Requirements Specification Development Product Deployment Specification Testing

Security Key Lifecycle Manager 11/11/2018 Security Key Lifecycle Manager IBM’s centralized key management solution for all encryption solutions SKLM Manage Encryption Keys Align with PCI & NIST Guidance Manage IBM and non-IBM products via KMIP Automatic Key Rotation Transparent Encryption and Key Management Storage Devices Non-Storage Tape: IBM LTO/ TSxxxx, TS77xx Virtualization Engine, Quantum, Spectra Logic IBM Disk: DS8xxx family, DS5xxx family Cloud Storage, Elastic Storage, Big Data, Data Warehouse (Spectrum family, Netezza) Network Storage (NetApp) Servers (Lenovo System x) Flash Storage 3rd Parties: EMC, Bloombase, Hitachi, Fujitsu Sensus Smart Meters Multi-Cloud Data Encryp- tion (MDE) VMware vSAN & VM DB2 Broadening Footprint

Self-Encrypting Devices IBM Security Key Lifecycle Manager (SKLM) Self-Encrypting Devices SKLM is a Key Distribution and Management software solution Uses standard protocols (i.e. KMIP: Key Management Interoperability Protocol) Provides centralized key mgmt for self-encrypting drives (tape, disk) Light-weight and highly-scalable SKLM helps customers keep data private, compliant, and encryption keys well-managed Expanding support for flash storage, cloud storage, network devices, etc. KMIP / IPP Disk Storage Arrays e.g. DS8000, DS5xxx, IBM Spectrum Accelerate (XIV), … SKLM Enterprise Tape Libraries e.g. TS11xx, TS2xxx, TS3xxx, Databases (e.g. DB2) Network storage servers (NetApp) SKLM Background Smart Meter Infrastructures Cloud file systems, Elastic Storage, Big Data / Data Warehouse (IBM Spectrum Scale Netezza, etc.) IBM Flash Storage Software: VMware vSphere Multi-Cloud Data Encryption

SKLM Multi-Master Deployment Architecture SKLM VMs Primary Data Center Apps and DBs Master Disk Storage Master Cloud Storage LAN/WAN Synchronized Servers Self-Encrypting Clients SKLM Encryption Key Management MDE KMIP/IPP SKLM VMs Elastic Storage Additional Data Centers Master Tape Libraries VMware vSAN & VM Encryption Master … …

Security Key Lifecycle Manager (SKLM) with HSM Integration Self-Encrypting Storage Self-Encrypting Storage SKLM without an external HSM SKLM external HSM SKLM SKLM KMIP / IPP KMIP / IPP HSM Wrapped Data Storage Keys Wrapped Data Storage Keys PKCS11 Master Key Obfuscated Master Key Unique Master Key per SKLM Master Key stored in SKLM Application Obfuscation hides Master Key All other keys encrypted (wrapped) under Master Key SKLM communicates with storage via KMIP or IPP Unique Master Key per SKLM Master Key stored in HSM All other keys encrypted (wrapped) under Master Key SKLM communicates with HSM via PKCS11 SKLM communicates with storage via KMIP or IPP

Support for new operating systems Operating System Name Windows 2012 Standard Edition x86-64 Windows 2012 R2 Standard Edition x86-64 Windows 2016 Server Edition x86-64 Red Hat Enterprise Linux (RHEL) Server 6 on x86-64 Red Hat Enterprise Linux (RHEL) Server 7 on x86-64 Red Hat Enterprise Linux (RHEL) Server 7 on z-systems Red Hat Enterprise Linux (RHEL) Server 7 on Power Little Endian SUSE Linux Enterprise Server (SLES) 12 on x86-64 SUSE Linux Enterprise Server (SLES) 12 on z-systems AIX 7.1 POWER System - Big Endian AIX 7.2 POWER System - Big Endian

11/11/2018 Mandatory closing slide with copyright and legal disclaimers.