This document provides an overview and summary of IBM's Security Key Lifecycle Manager (SKLM). It discusses SKLM's capabilities for encrypting and managing encryption keys for data at rest across different platforms and use cases. It highlights SKLM's key management features including its supported devices, keystores, master key and HSM integration. It also summarizes SKLM's deployment architectures including backup/restore, master-clone, and multi-master setups. The document concludes by outlining new enhancements in SKLM version 4 like REST APIs, improved performance and containerization.

1. 2020 z Security Webinars Series
Luigi Perrone
IBM Security Thought Leader
Security & Audit for zSystem & enterprise
Security Intelligence solution
luigi_perrone@it.ibm.com
https://www.linkedin.com/in/luigiperrone/

2. A quick view of the security evolution
Bolt-on security
for IT projects
SECURITY
INTELLIGENCE
APPS
MOBILE
ENDPOINT
THREAT
INTEL
NETWORK
ADVANCED
FRAUD
IDENTITY
& ACCESS
DATA
Security intelligence
across the enterprise
Connected security for
all, at the “speed of
cloud”
AI, quantum,
blockchain and
IoT security

3. IBM Security / © 2019 IBM Corporation 3
CISOs: “data security is a critical priority”
1. Get ahead of compliance demands
2. Protect against data breaches
3. Secure data across multiple clouds
4. Uncover business risk related to data
GDPR NY-DFS2
China Privacy
Australian Act
HIPAA
IaaS (Containers)
PaaS (DBaaS)
SaaS (O365)

4. IBM Security / © 2019 IBM Corporation 4
The famous IBM pyramid
Coverage
Complexity&SecurityControl
App
Encryption
hyper-sensitive data
Database Encryption
Provide protection for very sensitive in-
use (DB level), in-flight & at-rest data
File or Dataset Level Encryption
Provide broad coverage for sensitive data using encryption tied
to access control for in-flight & at-rest data protection
Full Disk and Tape Encryption
Provide 100% coverage for at-rest data with zero host CPU cost
Protection against
intrusion, tamper or
removal of physical
infrastructure
Broad protection & privacy managed
by OS… ability to eliminate storage
admins from compliance scope
Granular protection & privacy managed by
database… selective encryption & granular
key management control of sensitive data
Data protection & privacy provided and managed by
the application… encryption of sensitive data when
lower levels of encryption not available or suitable
Multiple layers of encryption

5. Why Should All Data at Rest be Encrypted?
Keeps sensitive information confidential
- Insider threat
- Lost/stolen tape or disk
- Disk being repaired (Solid-state disks fail in a read-only state)
• Addresses Regulations and Standards
- Privacy breach disclosure laws
- Protection of financial and healthcare data
• Simplifies end-of-life-of-media/data scenarios
- Destroy the key and the data is unusable
- Cryptographic Erasure (NIST SP800-88)
- Reducing media disposal costs

6. IBM Security / © 2019 IBM Corporation 6
Storage devices encryption capable

7. IBM Security / © 2019 IBM Corporation 7
The role of Key Server
Self-Encrypting Storage
(encrypts, Database (DB2),
applications and VMWare
(encrypts data)
Key Request
(IPP or KMIP)
Key Response
(IPP or KMIP)
Applications
SKLM Server
(key management)

8. SKLM
Data at RestVMWare, Apps, and IOT
Align with PCI &
NIST Guidance
Manage
Encryption Keys
Transparent
Encryption and
Key
Management
Automatic Key
Rotation
Manage IBM and
non-IBM
products via
KMIP
Broadening Footprint (IPP, KMIP, & REST-compatible)
Tape
Storage
Disk
Storage
Cloud and
Elastic
Storage
Lenovo
ServersIOT
Network
Storage
Flash
Storage
Multi-
Cloud
Apps
DB
VMware
vSAN &
vCenter
IBM Security Key Lifecycle Manager
Enforce
Separation of
Duties
IBM’s centralized key management solution for all data-at-rest encryption solutions

9. This standardization makes it easier for servers to support the growing number
of encryption clients who are supporting KMIP
The importance of KMIP support
• Key Management Interoperability Protocol (KMIP)
• Protocol for key management to encryption client
• Enables key lifecycle management (generation, submission, retrieval, and deletion)

10. IBM Security / © 2019 IBM Corporation 10
Who uses SKLM ?
29,000+ Installations across these enterprises
100+ Countries where SKLM is deployed
870+ Installations in Healthcare Enterprises
(Globally)
6,000+ Installations in Banking Enterprises (Globally)
11,000+ Installations in Insurance Enterprises (Globally)
4,200+ Enterprises have deployed SKLM

11. IBM Security / © 2019 IBM Corporation 11
What integrates with SKLM?
Any IPP- or KMIP-compatible
device or application
Databases
and
Applications
Tape
Storage
Solutions
Servers
Disk Storage
Solutions
Client DLP
Applications
Flash and
Hybrid
Storage
Elastic
Storage
Solutions
Cloud-based
Encryption
Solutions
SKLM is pursuing 100% KMIP-compatibility by offering interop testing with SKLM on SoftLayer!

12. IBM Security / © 2019 IBM Corporation 12
SKLM Supported Devices List available
http://ibm.biz/sklmdevicelist
Now published as
a Technote Link
(updated regularly).

13. IBM Security / © 2019 IBM Corporation 13
SKLM: main features

14. IBM Security / © 2019 IBM Corporation 14
Which platform ? Which OS ? Which version?
SKLM V4.0 for
distributed platforms
SKLM for z/OS V1.1
1. Server Platform:
• SKLM (distributed) servers can run on Windows, RHEL, Linux on z, and AIX
• SKLM for z/OS’s server is hosted on z/OS
2. Supported devices:
• SKLM (distributed) – Greater device support
3. KMIP Support:
• SKLM (distributed) – KMIP & IPP Support
• SKLM for z/OS – IPP Only
4. Hardware Key Storage/Protection:
• SKLM (distributed) optionally integrates with external HSMs (PKCS#11)
• SKLM for z/OS can leverage Z-HW (ICSF, RACF)
5. User Interface:
• SKLM (distributed) provides a graphical user interface.
• SKLM for z/OS is operator console command line based.
Main differences

15. IBM Security / © 2019 IBM Corporation 15
SKLM: Main Components
Software package consists of SKLM application, WebSphere and DB2

16. IBM Security / © 2019 IBM Corporation 16
SKLM Management
1. Setting up the master and clone systems for replication
2. Administering the groups, users, and roles
3. Administering devices, KMIP objects, and HSM
4. Running operational tasks such as data backup, data
restore, and export/import of device groups
5. Other miscellaneous administrative tasks
Administrative Tasks

17. IBM Security / © 2019 IBM Corporation 17
SKLM data redundancy to determine the architecture
BACKUP
RESTORE
MASTER
CLONES
MULTI
MASTER
Three methods to achive data redundancy

18. IBM Security / © 2019 IBM Corporation 18
Backup & Restore
COMMAND: tklmBackupRun
SKLM
With manual Backup/Restore you can back up cryptographic objects, configuration files,
and other critical information on the SKLM server and then restore them to create an exact
copy of the SKLM server

19. IBM Security / © 2019 IBM Corporation 19
Master-Clone Deployment Architecture
Tape Libraries
Disk Storage
Elastic Storage
Apps and DBs
SKLM VMs
CloneMaster
Primary
Data Center
Secondary
Data Center
LAN/WAN
Synchronized
Servers
… …
SKLM VMs
CloneClone
Cloud
Storage
SKLMEncryptionKeyManagement
Self-EncryptingDevices

20. IBM Security / © 2019 IBM Corporation 20
SKLM Multi-Master for hyper-redundancy
SKLM
NJ
Clients
SKLM
NY
Clients
SKLM
UK
Clients
SKLM
DE
Clients
SKLM
JP
Clients
…
SKLM
Site 21
Clients
Up to 21 sites of synchronized SKLM key servers

21. IBM Security / © 2019 IBM Corporation 21
Multi-Master Deployment Architecture (also with HSM)
SKLM VMs
MasterMaster
Primary Data
Center
Additional
Data Centers
LAN/WANSynchronized
Servers
… …
SKLM VMs
MasterMaster
SKLMEncryptionKeyManagement
Self-EncryptingClients
KMIP/IPP/REST
Tape Libraries
Disk Storage
SDS
Software Defined Storage
Apps and DBs
Cloud Storage
VMware vSAN
& vCenter
HSM
Network

22. IBM Security / © 2019 IBM Corporation 22
Multi-Master architecture in depth

23. IBM Security / © 2019 IBM Corporation 23
Keystore & Truststore
• The SKLM Truststore stores the trusted certificates and the
device root certificates that are used for secure communication
between SKLM and the client devices
• The standard installation of SKLM creates the truststore file
tklmTrustore.jceks
 <WAS_HOME>productssklmkeystore
• Generated keys and the metadata for the keys are
stored in a key table in the Keystore. The key materials
are protected by using a Master key.
SKLM can store symmetric keys, public keys, private keys, their associated certificate
chains, and trusted certificates.
KEYSTORE

24. IBM Security / © 2019 IBM Corporation 24
Managing the Master-Key
• The Master Key (AES 256-bit) is generated
by default in the SKLM server
• Key materials stored in the database are
protected by Master Key
• Each Device Group can have its own
Master Key

25. IBM Security / © 2019 IBM Corporation 25
Using an external HSM
https://www.ibm.com/support/pages/node/296957
The commonly supported cryptographic cards are :
• IBM 4765 PCIe Cryptographic Coprocessor
• Gemalto/SafeNet Luna SA
• Thales nShield Connect

26. IBM Security / © 2019 IBM Corporation 26
Security Key Lifecycle Manager (SKLM) with HSM Integration

27. IBM Security / © 2019 IBM Corporation 27
SKLM certificate management
• SKLM manages server and client certificates, and they are used for SSL and KMIP
communication

28. IBM Security / © 2019 IBM Corporation 28
Administering Group, Users, Role
• For specific drive (such as LTOtape drive it is possible to limit the range of activities for
administrator
• Administration of Users, Group and Role is done by WAS administrator

29. IBM Security / © 2019 IBM Corporation 29
LDAP Integration
• SKLM supports LDAP repositories, such as IBM Directory Server or Microsoft Active
Directory.
• Adding and configuring LDAP user repository to the federated repository of WAS using
the WAS GUI.

30. IBM Security / © 2019 IBM Corporation 30
SKLM Audit and Debug
Audit.handler.file.name property
> SKLM_DATA/config/SKLMConfig.properties
• Depending on the need, you can change the
default setting that SKLM uses to collect audit
information
• Configuring and generating the audit records in
syslog format

31. IBM Security / © 2019 IBM Corporation 31
Managing Device Groups
• CREATE GROUP
• CREATE ROLE
• VIEW GROUP
• EXPORT GROUP
• IMPORT GROUP
• MOVE DEVICE BETWEEN
GROUP

32. SKLM v4 enhancements

33. IBM Security / © 2019 IBM Corporation
• Manage and serve keys using REST APIs
• GUI refinements for local file management
• Improved Multi-Master cluster failover use cases
Capability
enhancements
• Run SKLM services as a non-root user
• SKLM containers on Docker (BETA release)
Deployment
enhancements
• Incremental replication
• Optimize SSL/TLS handshake for faster connectivity
Performance
improvements
• Key Archiving to reduce replication time for large key
databases
• Display replication errors on GUI
• Swagger UI for easy-to-use REST interface
Customer RFEs
SKLM v4.0 – Enhancements

34. IBM Security / © 2019 IBM Corporation 34
SKLM v4 enhancements: Installation, upgrade, migration
Administrator / RootSKLM
• SKLM processes run with no-admin or no-root credentials

35. IBM Security / © 2019 IBM Corporation 35
SKLM v4 enhancements: new REST-based key management
SKLM

36. IBM Security / © 2019 IBM Corporation 36
Symmetric Key
Key Pair
Client 1
KMIP Client
Certificate
Secret Data
Opaque Object
KMIP
REST
REST Client
For more information on. SKLM REST API capabilities, please go to:
https://www.ibm.com/support/knowledgecenter/SSWPVP_4.0.0/com.ibm.sklm.doc/refer
ence/ref/ref_ic_rest_rbks_clientmgmt.html
REST-based key serving: Overview

37. IBM Security / © 2019 IBM Corporation 37
Client Management APIs
• Create client
• Get client details
• List all clients
• Update client name
• Assign client certificate
• Assign users to client
• Remove users from client
• Delete client
• Create/Register symmetric key
• Create/Register key pair
• Create/Register secret data
• Register certificate
• Register opaque data
• Get object
• Delete object
• List all objects
Cryptographic Object Management APIs
REST-based key serving: API list
https://www.ibm.com/support/knowledgecenter/SSWPVP_4.0
.0/com.ibm.sklm.doc/reference/ref/ref_ic_rest_rbks_objmgmt.
html
https://www.ibm.com/support/knowledgece
nter/SSWPVP_4.0.0/com.ibm.sklm.doc/ref
erence/ref/ref_ic_rest_rbks_clientmgmt.ht
ml

38. IBM Security / © 2019 IBM Corporation 38
SKLM v4 enhancements: improved replication performance
SKLM
CLONE
SKLM
CLONE
SKLM MASTER

39. IBM Security / © 2019 IBM Corporation 39
SKLM v4 enhancements: Enhanced support for storage systems
SKLM
• DS8K-TCT
• PeerToPeer
New device groups for
DS8K Transparent Cloud
Tiering and Peer to Peer
for FC Endpoint Security

40. IBM Security / © 2019 IBM Corporation 40
SKLM v4 enhancements to the Multi-Master feature
• You can start, stop, and restart a Multi-Master cluster by using the graphical user
interface, REST interface, or scripts

41. IBM Security / © 2019 IBM Corporation 41
SKLM v4 enhancements: graphical user interface (GUI)
• From the Administration menu you can
change: user password, WAS password,
Database password
• Upload/download files from GUI
• From the Replication page you can display
the replication status
• Clients and Groups option is reneamed as
«Clients»
• Support to archive served key data

42. IBM Security / © 2019 IBM Corporation 42
SKLM v4 enhancements: interactive & easy REST API console
• Swagger UI is now integrated with IBM Security Key Lifecycle Manager, to
allow the use with any REST API.

43. IBM Security / © 2019 IBM Corporation 43
SKLM v4 enhancements: enhanced support for KMIP v.2.0
• IBM Security Key Lifecycle Manager now includes enhanced support for
Key Management Interoperability Protocol (KMIP) 2.0 profile.
SKLM MASTER
2.0

44. SKLM Container Edition : what is ?
• SKLM Container Edition will be formally GA’d 2H2020 ( v.4.1 Beta1)
• Beta use of SKLM C.E. requires an active entitlement to SKLM Basic Edition

45. SKLM C.E. components
DB2
Version 11.5
WASLiberty Base
Postgres
SQL
Version 12.2
You can also deploy SKLM containers on Kubernetes cluster using Helm charts (v.2.0)
https://kubernetes.io/docs/setup/
https://helm.sh/docs/intro/install/

46. SKLM Container
DB2 Container
Base ImagesUbuntu IBM DB2
Docker Volumes
Docker Engine
SKLM C.E. - High Level View
Admin REST Interface
Admin GUI Interface
Rest Based Key Serving
IPP Server
DB2 Database
Files
SKLM Data and
Artifacts
SKLM App and User DB
Environment
Variables
KMIP Server
*CLI is not
supported in
container

47. • CLI commands. Alternatively, use REST APIs.
• Multi-Master cluster
• Replication
• LDAP
• HSM
• Password change from the user interface
• Server restart is not supported. (you must restart
the application container)
• After user management changes, you must restart
the application container.
SKLM C.E. : restrictions

48. SKLM CE : conclusions
More information for deploying SKLM Container Edition can be found here:
• DockerHub link to SKLM Container Edition:
https://hub.docker.com/r/ibmcom/sklm
• System Requirements:
https://www.ibm.com/support/pages/deploying-ibm-security-key-lifecycle-manager-containerized-
environment-beta-release
• A License Activation File is required. It can be obtained from PPA or from Software Sellers Link.
More information can be found at:
https://www.ibm.com/support/pages/deploying-ibm-security-key-lifecycle-manager-containerized-
environment-beta-release
This is a BETA Release of SKLM C.E,
not designed or hardened for production use.

49. ibm.com/security
securityintelligence.com
xforce.ibmcloud.com
@ibmsecurity
youtube/user/ibmsecuritysolutions
© Copyright IBM Corporation 2019. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. Any statement of
direction represents IBM's current intent, is subject to change or withdrawal, and represent only goals and objectives. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines
Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.
Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in
information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single
product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve
additional operational procedures, and may require other systems, products or services to be most effective. IBM does not warrant that any systems, products or services are immune from, or will make your enterprise immune from, the
malicious or illegal conduct of any party.
THANK YOU
ibm.com/security/community