Contents

Title and Copyright Information

Preface

• What's New
• Related Documentation
• Documentation Accessibility

1 OKM Overview and Installation Planning

• OKM Cluster Overview
• Supported OKM Encryption Endpoints
  • How Encryption Endpoints Retrieve Keys from a KMA
  • Oracle Database with Transparent Data Encryption (TDE)
  • Oracle Solaris 11 ZFS Encryption
  • ZFS Storage Appliance
  • Java Applications using Java Cryptographic Extension Provider
  • Encryption Capable Tape Drives
• Key Management Appliance Overview
  • Specifications for OKM Servers
  • Specifications for Installing a KMA into a Rack
  • Hardware Security Module for KMA
• OKM Installation Planning Checklist
• Sample OKM Configurations
  • Single Site OKM Configuration
  • Dual Sites OKM Configuration
  • Dual Sites OKM Configuration with Disaster Recovery
  • Dual Sites OKM Configuration with Oracle Database
  • Multiple Sites OKM Configuration with Partitioned Library
• OKM Networking Overview
  • Management Network
  • Service Network
  • ILOM/ELOM
  • Managed Switches
  • Network Routing Configuration
• Part Numbers for OKM Components

2 Installing OKM Manager

• Supported Platforms for OKM Manager
• Uninstall Previous Version of OKM Manager
  • Uninstall OKM Manager by Invoking the Executable File
  • Uninstall OKM Manager by Using Add/Remove Programs (Windows Only)
• Download the OKM Installer
• Launch the OKM Installer
• Complete the OKM Installation Wizard
• Launch OKM Manager

3 Configuring a KMA with QuickStart

• Launch the KMA QuickStart Program
  • Launch the QuickStart from the ILOM Web Interface
  • Launch the QuickStart from the ILOM CLI
  • Launch the QuickStart from the ELOM Web Interface
  • What happens once the KMA startup completes?
• Review QuickStart Program Information and Set Keyboard Layout
• Configuring the Network in QuickStart
  • QuickStart Network Configuration Task 1: Set KMA Management IP Addresses
  • QuickStart Network Configuration Task 2: Enable Technical Support Account
  • QuickStart Network Configuration Task 3: Set the KMA Service IP Addresses
  • QuickStart Network Configuration Task 4: Modify Gateway Settings
  • QuickStart Network Configuration Task 5: Set DNS Configuration (Optional)
  • QuickStart Network Configuration Task 6: Set Acceptable TLS versions
• Name the KMA
• Create a New Cluster with QuickStart
  • Create New Cluster Task 1: Enter Key Split Credentials
  • Create New Cluster Task 2: Enter Initial Security Officer User Credentials
  • Create New Cluster Task 3: Specify Autonomous Unlocking Preference
  • Create New Cluster Task 4: Set the Key Pool Size
  • Create New Cluster Task 5: Select Certificate Signature Algorithm
  • Create New Cluster Task 6: Synchronize the KMA time
• Join an Existing Cluster
  • Accelerating Updates to the New KMA in a Cluster
• Restore a Cluster from a Backup
  • Restore a Cluster Task 1: Create Security Officer and Provide Quorum Login
  • Restore a Cluster Task 2: Set Time Information
  • Restore a Cluster Task 3: Restore the Backup using OKM Manager

4 Configuring the Cluster

• Checklist for Configuring a Cluster
• Connect to a KMA
  • Create a Cluster Profile
  • Delete a Cluster Profile
• Review and Modify the Cluster Security Parameters
• Enroll Agents

5 Basic OKM GUI Operations

• Disconnect from the KMA
• Using Online Help
• Filtering Lists
• Export a List as a Text File (Save Report)
• Passphrase Requirements
• Navigate the OKM GUI with the Keyboard
• Specify the GUI Configuration Settings
  • IPv6 Addresses with Zone IDs

6 Managing Users and Roles

• Change Your Passphrase
• View a List of Users
• Create a User
• Modify a User's Details and Set the User's Passphrase
• Delete a User
• View Roles and Valid Operations
  • Available Roles
  • Valid Operations for Each Role

7 Monitoring KMAs

• Configure SNMP
  • SNMP Protocol Versions
  • SNMP MIB Data
  • View SNMP Managers for a KMA
  • Create a New SNMP Manager
  • Modify an SNMP Manager's Details
  • Delete an SNMP Manager
• Configure the Hardware Management Pack (HMP)
  • Download the HMP MIBs from the OKM Manager GUI
  • Download the HMP MIBs from My Oracle Support
  • HMP Prerequisites
  • Enable/Disable HMP
• Display the Current Load
• View and Export Audit Logs
• Create a System Dump
• Send Messages to Remote Syslog Servers
  • Configure TLS for Remote Syslog Communication
  • Create a Remote Syslog Server
  • View or Modify Remote Syslog Details
  • Test Remote Syslog Support
  • Delete a Remote Syslog Server

8 Backups

• What is a Core Security Backup?
• What is a Database Backup?
• View Backup File Information
• Create a Core Security Backup
• Create a Database Backup
• Restore a Backup
• Destroy a Backup

9 Keys, Key Policies, and Key Groups

• What is the difference between Keys, Key Policies, and Key Groups?
• OKM Key States and Transitions
• Key Lifecycle
• Manage Key Policies
  • View Key Policies
  • Create a Key Policy
  • Modify a Key Policy
  • Delete a Key Policy
• Manage Key Groups
  • View Key Groups
  • Create a Key Group
  • Modify a Key Group's Details
  • Delete a Key Group
  • Assign Agents to Key Groups
  • Assign a Transfer Partner to a Key Group
  • Import a KMS 1.0 Key Export File
• Manage Keys
  • Query Keys
  • Compromise Keys
• Transfer Keys Between Clusters
  • Configure Key Transfer Partners
  • Export a Transfer Partner Key
  • Import Transfer Partner Keys
  • View the Transfer Partner List
  • View the Key Transfer Public Key List
  • Modify Transfer Partner Details
  • Delete a Transfer Partner
  • Share Keys with Older Clusters

10 Sites, KMAs, Agents, and Data Units

• Manage KMAs
  • View a List of KMAs
  • Create a KMA
  • Modify KMA Details
  • Set a KMA Passphrase
  • Delete a KMA
  • Query KMA Performance
  • Modify Key Pool Size
  • Lock/Unlock the KMA
  • Check the Replication Version of the KMA
  • Upgrade Software on a KMA
  • View KMA Network Configuration Information
  • View and Adjust the KMA Clock
  • Check the Hardware Security Module
• Manage Sites
  • View Sites
  • Create a Site
  • View and Modify a Site's Details
  • Delete a Site
• Manage Agents
  • View a List of Agents
  • Create an Agent
  • Modify an Agent
  • Set an Agent's Passphrase
  • Assign Key Groups to an Agent
  • Delete Agents
  • Query Agent Performance
• Manage Data Units
  • View Data Units
  • View and Modify Data Unit Details
  • View Data Unit Key Details
  • View Backups with Destroyed Keys
  • Destroy Post-operational Keys for a Data Unit
  • View Key Counts

11 Quorum Operations

• Key Split Quorum Authentication
  • View the Key Split Configuration
  • Modify the Key Split Configuration
• Operations that Require a Quorum
• View Pending Operations
• Approve Pending Quorum Operations
• Delete Pending Quorum Operations

12 Using the OKM Console

• OKM Console Overview
• Log into the KMA
• User Role Menu Options
  • Operator Menu Options
  • Security Officer Menu Options
  • Combined Operator and Security Officer Menu Options
  • Menu Options for Other Roles
• OKM Console Functions
  • Restart the KMA
  • Shut Down the KMA
  • Enable the Technical Support Account
  • Disable the Technical Support Account
  • Enable the Primary Administrator
  • Disable the Primary Administrator
  • Log the KMA Back into the Cluster
  • Set a User's Passphrase
  • Set the KMA Management IP Addresses
  • Set the KMA Service IP Addresses
  • View, Add, and Delete Gateways
  • Set Acceptable TLS Versions
  • Specify the DNS Settings
  • Reset the KMA to the Factory Default
  • Set the Keyboard Layout
  • Show Properties of the Root CA Certificate
  • Renew the Root CA Certificate
  • Log Out of Current OKM Console Session

13 Command Line Utilities

• OKM Command Line Supported Platforms
• OKM Command Line Utility
  • OKM Command Line Subcommand Descriptions
  • OKM Command Line Options
  • OKM Command Line Filter Parameters
  • OKM Command Line Examples
  • OKM Command Line Exit Values
  • OKM Command Line Sample Perl Scripts
• Backup Command Line Utility
  • Backup Command Line Solaris Syntax
  • Backup Command Line Windows Syntax
  • Backup Command Line Parameter Descriptions
  • Backup Command Line Example

14 Managing Certificates

• Generating Certificates and Signing Using SHA-256
  • Generating Certificates Task 1: Renew the Root Certificate
  • Generating Certificates Task 2: Perform an OKM Backup
  • Generating Certificates Task 3: Retrieve the New Root CA on Peer KMAs (optional)
  • Generating Certificates Task 4: Reissue Certificates for Agents (optional)
  • Generating Certificates Task 5: Update Users (optional)
  • Generating Certificates Task 6: Update Disaster Recovery Records
• Ongoing Renewal Policy for the Root CA Certificate
• Saving Certificates
  • Convert PKCS#12 Format to PEM Format

A Disaster Recovery

• Recovering a KMA
• Considerations When Performing Backups and Key Sharing
• Determining Key Pool Size
• Example Scenarios for Recovering Data
  • Replicating from Another Site
  • Using a Dedicated Disaster Recovery Site
  • Using Shared Resources for Disaster Recovery
  • Using Key Transfer Partners for Disaster Recovery

B Network Configuration for the SL4000

• Configure the SL4000 OKM Network Port
• Configure the KMA to Connect with the SL4000
• Enable SL4000 Drive Access Using MDVOP

C OKM-ICSF Integration

• Key Stores and Master Key Mode
• Understanding the ICSF Solution
• Defining the ICSF System Components
• System Requirements for ICSF
• IBM Mainframe Configuration for ICSF
  • Installing and Configuring the CEX2C Cryptographic Card for ICSF
  • StorageTek ELS Setup for OKM-ICSF
  • Preparing ICSF
  • Configuring AT-TLS
• Updating OKM Cluster Information

D Using OKM with Advanced Security Transparent Data Encryption (TDE)

• Overview of Transparent Data Encryption (TDE)
  • OKM PKCS#11 Provider
  • TDE Authentication with OKM
• Load Balancing and Failover When Using pkcs11_kms
• Planning Considerations When Using TDE
  • Oracle Database Considerations When Using TDE
  • OKM Performance and Availability Considerations When Using pkcs11_kms
  • Network and Disaster Recovery Planning When Using pkcs11_kms
  • Key Management Planning When Using pkcs11_kms
• Integrate OKM and TDE
  • System Requirements for OKM and TDE
  • Install OKM for TDE
  • Install pkcs11_kms
  • Uninstall pkcs11_kms
  • Configure Database for TDE
  • Configure the OKM Cluster for TDE
  • Configure kcs11_kms
• Migration of Master Keys from the Oracle Wallet
  • Re-Key Due to OKM Policy Based Key Expiration
• Convert from Another Hardware Security Module Solution
• Key Destruction When Using TDE
• Key Transfer in Support of Oracle RMAN and Oracle Data Pump
• Attestation, Auditing, and Monitoring for TDE
• Locate TDE Master Keys in OKM
• Troubleshooting When Using pkcs11_kms
  • Cannot Retrieve the Master Key When Using pkcs11_kms
  • Loss of the pkcs11_kms Configuration Directory
  • No Slots Available Error When Using pkcs11_kms
  • CKA_GENERAL_ERROR Error When Using pkcs11_kms
  • Could Not Open PKCS#12 File Error

E Using OKM with Solaris ZFS Encryption

• Using pkcs11_kms with ZFS
• Planning Considerations When Using ZFS
• Integrating OKM and ZFS
  • Configure the OKM Cluster for ZFS
  • Install pkcs11_kms on Solaris 11
  • Configure pkcs11_kms on Solaris 11
  • Configure ZFS to Use pkcs11_kms
  • Troubleshooting When Using pkcs11_kms

F Service Processor Procedures

• ILOM Procedures
  • Related Documentation for ILOM
  • ILOM Upgrade Overview
  • Configure ILOM – SPARC T7-1, Netra SPARC T4-1 and Sun Fire X4170 M2 Servers
  • Verify ILOM and OBP or BIOS Levels
  • Upgrade the ILOM Server Firmware
  • Setting the boot Mode for OpenBoot from the ILOM - SPARC KMAs Only
  • Launch the BIOS Setup Utility from the ILOM - Sun Fire X4170 M2 Only
  • ILOM Security Hardening
  • Configure OpenBoot Firmware - SPARC KMAs Only
  • Configure the BIOS - Sun Fire Servers Only
• ELOM Procedures
  • ELOM Upgrade Overview
  • Related Documentation for ELOM
  • Configure ELOM – Sun Fire X2100 M2 or X2200 M2 Servers
  • Verify ELOM and BIOS Levels
  • Upgrade the ELOM Server Firmware
  • Launch the BIOS Setup Utility from the ELOM
• Attach a Keyboard and Monitor to the KMA

Index