Chapter 12. Encryption 627
5. You can confirm that encryption is enabled and verify which key providers are in use by 
clicking Settings → Security → Encryption, as shown in Figure 12-29.
Figure 12-29   Encryption view showing using USB flash drives as the enabled provider
12.4.3  Enabling encryption using key servers
A key server is a centralized system that receives and then distributes encryption keys to its 
clients, including IBM Spectrum Virtualize systems. 
IBM Spectrum Virtualize supports use of the following key servers as encryption key 
providers:
/SM590000IBM Security Key Lifecycle Manager (SKLM)
/SM590000Gemalto SafeNet KeySecure
SKLM and KeySecure SafeNet support Key Management Interoperability Protocol (KMIP), 
which is a standard for management of cryptographic keys.
IBM Spectrum Virtualize code V8.1 and later supports up to four key server objects that are 
defined in parallel. But, only one key server type (SKLM or KeySecure) can be enabled at one 
time.
Another characteristic when working with key servers is that it is not possible to migrate from 
one key server type directly to another. If you want to migrate from one type to another, you 
first need to migrate from your current key server to USB encryption, and then migrate from 
USB to the other type of key server.
Note: Support for IBM Security Key Lifecycle Manager was introduced in IBM Spectrum 
Virtualize V7.8. Support for Gemalto SafeNet KeySecure was introduced in IBM Spectrum 
Virtualize V8.2.1.
Note: Make sure that the key management server functionality is fully independent from 
encrypted storage that has encryption managed by this key server environment. Failure to 
observe this requirement might create an encryption deadlock. An encryption deadlock is a 
situation in which none of key servers in the environment can become operational because 
some critical part of the data in each server is stored on a storage system that depends on 
one of the key servers to unlock access to the data.