If you configured external key management and then later move secure-enabled drives from one storage system to another, you must re-assign the security key to the new storage system to gain access to the encrypted data on the drives.

Before you begin

On the source array (the array where you are removing the drives), you have exported volume groups and removed the drives. On the target array, you have re-installed the drives.

The Export/Import function is not supported in the SANtricity System Manager user interface; you must use the Command Line Interface (CLI) to export/import a volume group to a different storage system.

The Drive Security feature must be enabled. Otherwise, a Cannot Create Security Key dialog box opens during this task. If necessary, contact your storage vendor for instructions on enabling the Drive Security feature.
You must know the key management server’s IP address and port number.
You have a signed client certificate file for the storage system’s controllers, and you have copied that file to the host where you are accessing SANtricity System Manager. A client certificate validates the storage system’s controllers, so the key management server can trust their Key Management Interoperability Protocol (KMIP) requests.
You must retrieve a certificate file from the key management server, and then copy that file to the host where you are accessing SANtricity System Manager. A key management server certificate validates the key management server, so the storage system can trust its IP address. You can use a root, intermediate, or server certificate for the key management server.

For more information about the server certificate, consult the documentation for your key management server.

About this task

When you use external key management, the security key is stored externally on a server designed to safe-guard security keys. A security key is a string of characters that is shared by the controller and drives for read/write access. When the drives are physically removed from the array and installed in another, they cannot operate until you provide the correct security key.

You can create either an internal key from the controller’s persistent memory or an external key from a key management server. This topic describes unlocking data when external key management is used. If you used internal key management, see Unlock drives when using internal key management.

Once you reinstall secure-enabled drives in another array, that array discovers the drives and displays a "Needs Attention" condition along with a status of "Security Key Needed." To unlock drive data, you import the security key file and enter the pass phrase for the key. (This pass phrase is not the same as the storage system’s Administrator password.) During this process, you configure the storage system to use an external key management server and then the secure key will be accessible. You are required to provide contact information of the server for the storage system to connect and retrieve the security key.

If other secure-enabled drives are installed in the new storage system, they might use a different security key than the one you are importing. During the import process, the old security key is used only to unlock the data for the drives you are installing. When the unlock process is successful, the newly installed drives are re-keyed to the target storage system’s security key.

Steps

Select Settings > System.
Under Security key management, select Create External Key.
Complete the wizard with the prerequisite connection information and certificates.
Click Test Communication to ensure access to the external key management server.
Select Unlock Secure Drives.

The Unlock Secure Drives dialog box opens. Any drives that require a security key are shown in the table.
Optional: hover the mouse over a drive number to see the location of the drive (shelf number and bay number).
Click Browse, and then select the security key file that corresponds to the drive you want to unlock.

The key file you selected appears in the dialog box.
Enter the pass phrase associated with this key file.

The characters you enter are masked.
Click Unlock.

If the unlock operation is successful, the dialog box displays: "The associated secure drives have been unlocked."

Results

When all drives are locked and then unlocked, each controller in the storage system will reboot. However, if there are already some unlocked drives in the target storage system, then the controllers will not reboot.

After you finish

On the destination array (the array with the newly installed drives), you can now import volume groups.