Chapter 12. Encryption 635
12.Confirm that encryption is enabled in Settings → Security → Encryption, as shown in 
Figure 12-40. Note the Online state that indicates which SKLM servers are detected as 
available by the system.
Figure 12-40   Encryption enabled with only SKLM servers as encryption key providers
Enabling encryption using SafeNet KeySecure
IBM Spectrum Virtualize V8.2.1 introduces support for Gemalto SafeNet KeySecure, which is 
a third-party key management server. It can be used as an alternative to IBM Security Key 
Lifecycle Manager (SKLM).
IBM Spectrum Virtualize supports Gelmato SafeNet KeySecure version 8.3.0 and later, and 
only using KMIP protocol. It is possible to configure up to four SafeNet KeySecure servers in 
IBM Spectrum Virtualize for redundancy, and they can coexist with USB flash drive 
encryption.
It is not possible to have both SafeNet KeySecure and SKLM key servers configured at the 
same time in IBM Spectrum Virtualize. It is also not possible to migrate directly from one type 
of key server to another (from SKLM to SafeNet KeySecure or vice-versa). If you want to 
migrate from one type to another, first migrate to USB flash drives encryption, and then, 
migrate to the other type of key servers.
KeySecure uses an active-active clustered model. All changes to one key server are instantly 
propagated to all other servers in the cluster.
Although KeySecure uses KMIP protocol as IBM SKLM does, an option is available to 
configure the user name and password for IBM Spectrum Virtualize and KeySecure server 
authentication, which is not possible when the configuration is performed with SKLM.
The certificate for client authentication in SafeNet KeySecure can be self-signed or signed by 
a Certificate Authority.