34 Implementing the IBM Storwize V7000 with IBM Spectrum Virtualize V8.2.1
It is possible to demonstrate the potential benefit of IBM Easy Tier in the environment before 
installing different drives. When IBM Easy Tier is turned on, the algorithm produces the 
statistic file that can be offloaded from IBM Storwize V7000.
The IBM Storage Tier Advisor Tool (STAT) can be used to create a summary report that uses 
the statistic file offloaded from IBM Storwize V7000.
The STAT tool is available at this website.
2.5.18  Encryption
IBM Storwize V7000 provides optional encryption of data at rest, which protects against the 
potential exposure of sensitive user data and user metadata that is stored on discarded, lost, 
or stolen storage devices. Encryption of system data and system metadata is not required, so 
system data and metadata are not encrypted.
Planning for encryption involves purchasing a licensed function and then activating and 
enabling the function on the system. A license is required to encrypt data that is stored on 
drives. When encryption is activated and enabled on the system, valid encryption keys must 
be present on the system when the system unlocks the drives or the user generates a key.
IBM Spectrum Virtualize V7.4, hardware encryption was introduced, with software encryption 
introduced in V7.6. Encryption keys can be managed by IBM SKLM or stored on USB flash 
drives that are attached to a minimum of one of the nodes. Since V8.1, a combination of 
SKLM and USB key repositories can be used. 
IBM Security Key Lifecycle Manager is an IBM solution that provides the infrastructure and 
processes to locally create, distribute, backup, and manage the lifecycle of encryption keys 
and certificates. Before activating and enabling encryption, you must determine the method of 
accessing key information during times when the system requires an encryption key to be 
present.
When Security Key Lifecycle Manager is used as a key manager for encryption, you can run 
into a deadlock situation when the key servers are hosted on encrypted storage provided by 
the IBM Storwize V7000. That is, if the storage that is used by these SKLM servers is 
allocated from the encrypted pool on the same Storwize V7000. To avoid a deadlock 
situation, ensure that the IBM Storwize V7000 node canisters can communicate with an 
encryption server to get the unlock key after a power-on or restart scenario.
Data encryption is protected by the Advanced Encryption Standard (AES) algorithm that uses 
a 256-bit symmetric encryption key in XTS mode, as defined in the Institute of Electrical and 
Electronics Engineers (IEEE) 1619-2007 standard as XTS-AES-256. That data encryption 
key is protected by a 256-bit AES key wrap when stored in non-volatile form.
2.5.19  iSCSI
iSCSI is an alternative means of attaching hosts and external storage controllers to the IBM 
Storwize V7000. Within IBM Spectrum Virtualize release 7.7, IBM introduced software 
capabilities to allow the underlying virtualized storage to attach to IBM Storwize V7000 by 
using the iSCSI protocol.