Protecting master encryption key

Edit online

The IBM Storage Protect server uses a master encryption key to decrypt the data that is stored in the cloud-container storage pools. It is important to protect the master encryption key to enable the server for decrypting the data stored in the cloud-container storage pools.

Before you begin

You must configure a default device class for database backups on the server.

About this task

The following files must be protected to decrypt the data that is stored in the cloud-container storage pool:
  • dsmkeydb.kdb: The key database file that contains the master encryption key.
  • dsmkeydb.dsh: The password stash file that the server uses to access the dsmkeydb.kdb key database file.
To safeguard dsmkeydb files against a possible corruption, or loss, you must backup the master encryption key as part of a scheduled or manual database backup. You can protect the backup copy of the master encryption key by securing the database backup with a password. This same password is required to restore the master encryption key from the database backup.
Important: The server does not define an encrypted cloud-container storage pool unless the database backups are defined to include the master encryption key by default.

Procedure

To include the master encryption key in server database backups, complete the following steps:

  1. Issue the QUERY DB command with FORMAT=DETAILED parameter to check whether database backups are configured to include the master encryption key.
    Tip: You can also check whether database backups are configured to include the master encryption key by using the Operations Center. To check the status, complete the following steps:
    1. On the Operations Center menu bar, click Servers.
    2. On the Servers page, select the server and click Details.
    3. On the Details page, click the Properties tab. The Database Backup and Recovery section shows whether backups are configured to include the master encryption key.
  2. Issue the SET DBRECOVERY command with the PROTECTKEYS=YES and PASSWORD parameter to configure the database backups to include the master encryption key. 
    SET DBRECOVERY device_class_name PROTECTKEYS=YES PASSWORD=password
    Important: Store the password in a secure location. The master encryption key cannot be recovered without this password.