When using NetApp Volume Encryption (NVE) which type of server is needed to keep encryption keys separate from encrypted data?

NetApp Volume Encryption (NVE) allows for keys to be managed either by an onboard key manager or by an external key management server (KMS). To achieve the security goal of keeping encryption keys separate from the encrypted data, an external KMS must be used. ONTAP systems communicate with these external servers using the industry-standard Key Management Interoperability Protocol (KMIP). Therefore, a KMIP-compliant server is the required type to manage and serve encryption keys for NVE when external key management is implemented.

B. RADIUS: This is a protocol for centralized user authentication, authorization, and accounting (AAA), not for managing storage encryption keys.

C. TLS: This protocol secures data in transit over a network. It is not a server type for storing data-at-rest encryption keys.

D. TKIP: This is a deprecated security protocol for Wi-Fi (IEEE 802.11) networks and is unrelated to NetApp storage encryption.

1. NetApp ONTAP 9 Documentation

"Security and data encryption

" section "Managing encryption keys with an external key manager." It states: "You can use an external key manager to serve keys to ONTAP for the encryption of data. ONTAP uses the Key Management Interoperability Protocol (KMIP) to communicate with external key managers."

2. NetApp Technical Report 4567 (TR-4567)

"NetApp ONTAP Security Hardening Guide." Section 5.1

"Encryption

" details the use of NetApp Volume Encryption (NVE) and NetApp Aggregate Encryption (NAE) with external KMIP-compliant key managers for separating keys from data.

3. NetApp ONTAP 9 Documentation

"ONTAP concepts

" section "How NetApp Volume Encryption works." This section explains: "For key management

you can use an onboard key manager or external KMIP-compliant key managers."