622 Implementing the IBM Storwize V7000 with IBM Spectrum Virtualize V8.2.1
The next section presents a scenario in which both encryption key providers are enabled at 
the same time. For more information about how to enable encryption by using only USB flash 
drives, see 12.4.2, “Enabling encryption using USB flash drives” on page 622. 
For more information about how to enable encryption by using key servers as the sole 
encryption key provider, see 12.4.3, “Enabling encryption using key servers” on page 627.
12.4.2  Enabling encryption using USB flash drives
Using USB flash drives as the encryption key provider requires a minimum of three USB flash 
drives to store the generated encryption keys. Because the system attempts to write the 
encryption keys to any USB key that is inserted into a node port, it is critical to maintain 
physical security of the system during this procedure.
While the system enables encryption, you are prompted to insert USB flash drives into the 
system. The system generates and copies the encryption keys to all available USB flash 
drives.
Ensure that each copy of the encryption key is valid before you write any user data to the 
system. The system validates any key material on a USB flash drive when it is inserted into 
the canister. If the key material is not valid, the system logs an error. If the USB flash drive is 
unusable or fails, the system does not display it as output. Figure 12-26 on page 625 shows 
an example where the system detected and validated three USB flash drives.
If your system is in a secure location with controlled access, one USB flash drive for each 
canister can remain inserted in the system. If a risk of unauthorized access exists, all USB 
flash drives with the master access keys must be removed from the system and stored in a 
secure place.
Securely store all copies of the encryption key. For example, any USB flash drives that are 
holding an encryption key copy that are not left plugged into the system can be locked in a 
safe. Similar precautions must be taken to protect any other copies of the encryption key that 
are stored on other media.
Note: The system needs at least three USB flash drives to be present before you can 
enable encryption by using this encryption key provider. IBM USB flash drives are 
preferred and can be obtained from IBM with the feature name Encryption USB Flash 
Drives (Four Pack). Other flash drives might also work. You can use any USB ports in any 
node of the cluster. 
Notes: Generally, create at least one extra copy on another USB flash drive for storage in 
a secure location. You can also copy the encryption key from the USB drive and store the 
data on other media, which can provide extra resilience and mitigate risk that the USB 
drives used to store the encryption key come from a faulty batch. 
Every encryption key copy must be stored securely to maintain confidentiality of the 
encrypted data.