Using Fortanix Data Security Manager with Spectra Logic

1.0 Introduction

This article describes how to integrate Fortanix-Data-Security-Manager (DSM) with Spectra Logic to enable encryption key management for securing data stored in Spectra Logic LumOS Tape Libraries.

It also provides essential information for:

• Configuring and initializing Fortanix DSM

• Setting up Spectra Logic LumOS Tape Libraries to connect with Fortanix DSM using the Key Management Interoperability Protocol (KMIP)

• Configuring and verifying the LumOS KMIP server

2.0 Prerequisites

Before integrating Fortanix DSM with Spectra Logic, ensure that the following requirements are met:

• A Fortanix DSM account. For steps to create an account, refer to the User's Guide: Getting Started with Fortanix Data Security Manager - UI.

• LumOS version: 1.51 and above

• Supported library: TFinity Series Tape Library

• Network connectivity with Internet access

  • Run the following command to test the connectivity within the TFinity network:

    curl https://<Fortanix DSM test endpoint>

    For example,

    curl https://amer.smartkey.io

3.0 Product Version Tested

The following product versions were tested:

• Fortanix DSM version 4.36

• LumOS version 1.51 and above

4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

4.1 Signing Up

4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

4.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the Groups menu item, and then click the + button to create a new group.

   

2. On the Adding new group page, do the following:

   1. Title: Enter a name for your group.

   2. Description (optional): Enter a short description of the group.

3. Click SAVE to create the new group.

The new group has been added to the Fortanix DSM successfully.

4.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the Apps menu item, and then click the + button to create a new app.

   

2. On the Adding new app page, do the following:

   1. App name: Enter the name for your application.

   2. ADD DESCRIPTION (optional): Enter a short description of the application.

   3. Authentication method: Select the default API Key as the authentication method from the drop down menu. For more information on these authentication methods, refer to the User's Guide: Authentication.

   4. Assigning the new app to groups: Select the group created in Section 4.3: Creating a Group from the list.

3. Click SAVE to add the new application.

The new application has been added to the Fortanix DSM successfully.

4.5 Copying the API UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the Apps menu item, and then click the app created in Section 4.4: Creating an Application to go to the detailed view of the app.

2. From the top of the app’s page, click the copy icon next to the app UUID to copy it to use in Step 2 of Section 5.4: Generate and Sign the CSR.

5.0 Integrate Spectra Logic LumOS with Fortanix DSM

Spectra Logic LumOS must be integrated with Fortanix DSM using KMIP to generate a certificate and enable encryption key management.

5.1 Log in to Spectra LumOS

Perform the following steps to log in to Spectra LumOS:

1. Open the Spectra Logic LumOS login page.

2. Enter your login credentials and click LOGIN to access the Dashboard.

   

5.2 Access and Configure LumoS Encryption Settings

After successful login, perform the following steps to access the Encryption settings from the Dashboard:

1. Hover over Dashboard and click Configuration.

   

2. On the Configuration dashboard, click Encryption.

   

3. You will be prompted for a password to configure encryption. The default password is blank (no password).

   

   You can optionally configure a password using the AUTHORIZATION SETTINGS for added protection.

   

5.3 Configure LumOS KMIP Encryption

On the Encryption page, after authorization, you can access the following tabs:

• BLUESCALE ENCRYPTION

• KMIP ENCRYPTION

Perform the following steps to configure the KMIP encryption to generate a Certificate Signing Request (CSR):

1. Select the KMIP ENCRYPTION tab.

2. Click GENERATE NEW CSR.

5.4 Generate and Sign the CSR

Perform the following steps to generate and sign the CSR to use it in Fortanix DSM:

1. Click GENERATE NEW CSR on the KMIP ENCRYPTION tab.

2. In the New Certificate Signing Request form,

   1. Enter the Common Name using the app UUID copied in Section 4.5: Copying the App UUID. For example, a7004f82-622f-451e-bb23-9f78dd1966fe.

   2. Click GENERATE CSR to create the CSR.

   

3. Take this CSR and use your Certificate Authority (CA) to sign the CSR and issue the certificate.

   

5.5 Update the Certificate in Fortanix DSM

Once the CSR is signed and a new certificate is issued, perform the following steps to upload the certificate to Fortanix DSM:

1. Go to the detailed view of the app created in Section 4.4: Creating an Application and click Change the authentication method, and select the Certificate option to change the authentication method to Certificate.

2. Click SAVE.

3. On the Add certificate dialog box, click UPLOAD NEW CERTIFICATE to upload the certificate file or paste the content of the certificate generated in the previous section.

4. Select both the check boxes to confirm your understanding about the action.

5. Click UPDATE to save the changes.

5.6 Import the Signed Client Certificate and Server CA Certificate in LumOS

Perform the following steps to import the signed client certificate and server CA certificate into the LumOS server:

1. On the KMIP ENCRYPTION tab in the LumOS interface, click IMPORT CERTIFICATE ARTIFACTS.

   

2. In the Import Certificate Artifacts dialog box, import the Signed Client Certificate using one of the following methods:

   1. Paste: If you have the certificate in text format, copy the entire certificate text and paste it directly into the entry field.

   2. Upload: If the signed certificate is saved as a file on your local machine, click Upload, browse to the file location, select it, and upload it.

   

3. Click NEXT to import the local server CA certificate.

4. In the Import Certificate Artifacts screen, import the Local Server CA Certificate using one of the following methods:

   1. Paste: If you have the certificate in text format, copy the entire certificate text and paste it directly into the entry field.

   2. Upload: If the certificate is saved as a file on your local machine, click Upload, browse to the file location, select it, and upload it (use the Intermediate CA certificate if applicable).

      NOTE

      • To save the local server CA certificate, go to the Fortanix DSM UI, view the site information, and export the CA certificate using the following path: Connection is secure → Certificate is valid → Details → Certificate → Export. Save the certificate to a file on your local machine.  

      • If the DSM TLS certificate chain includes an intermediate certificate, use the intermediate certificate file when importing into LumOS.

   

5. Click CONFIRM IMPORT. A success message appears once both the signed client certificate and the server CA certificate have been uploaded successfully.

   

6. Click IMPORT COMPLETE to return to the KMIP ENCRYPTION screen.

5.7 Configure LumOS KMIP Server

After importing the certificates in LumOS, perform the following steps to configure the LumOS KMIP server and complete the integration:

1. Click ADD KMP SERVER in the KMIP ENCRYPTION tab.

2. On the KMIP Server Configuration dialog box,

   1. Enter the Fortanix DSM host name in Hostname or IP Address field. For example, amer.smartkey.io.

   2. Enter the Port Number as 5696.

   3. Click SAVE to configure the LumOS KMIP server.

5.8 Verify KMIP Server Connection

After configuration, check the KMIP server connection status on the KMIP Encryption tab.

The status may take a few minutes to turn green, indicating a successful connection between Spectra Logic and Fortanix DSM.