After the encryption keys have been created, you can export the encryption key information. You can also rekey the key encryption key (KEK) and rekey the certificate encryption keys (CEKs). If your storage system is configured to acquire the key encryption key (KEK) from the key management server when the storage system starts and the acquisition fails, you can retry the key encryption key acquisition. After you have disabled encryption on all parity groups, you can initialize the encryption environmental settings on your storage system.
The VSP Gx00 models and VSP Fx00 models provide a performance-friendly AES-256-XTS encryption capability on the back-end I/O director. This capability protects data at rest on internal storage media (including disk drives and flash drives) attached to those directors. While many levels of encryption are available to the enterprise, protecting data at rest by using the array-level encryption of the storage system provides the following advantages: causes minimal to no performance impact within your operations, remains transparent to existing host servers and switches, shreds storage media by deleting the encryption key, simplifies key management to reduce the risk of the loss of encryption keys and data, and supports logging of encryption and key management events. In addition, many regulations encourage or require encryption of personally identifiable information (PII) and other sensitive data. Array-level encryption handles this type of data as well.
