GLYPH<SM590000> USB flash drives are not left inserted into the system except as required GLYPH<SM590000> Physical access to the system is not required to process a rekeying operation GLYPH<SM590000> Support for businesses that have security requirements not to use USB ports GLYPH<SM590000> Strong key generation GLYPH<SM590000> Key self-replication and automatic backups GLYPH<SM590000> Implementations follow an open standard that aids in interoperability GLYPH<SM590000> Audit detail GLYPH<SM590000> Ability to administer access to data separately from storage devices For the most secure operation, do not keep the USB flash drives inserted into the nodes  on the system. However, this method requires that you manually insert the USB flash  drives that contain copies of the encryption key in the nodes during operations that the  system requires an encryption key to be present.  USB flash drives that contain the keys must be stored securely to prevent theft or loss.  During operations that the system requires an encryption key to be present, the USB flash  drives must be inserted manually into each node so data can be accessed. After the  system completes unlocking the drives, the USB flash drives must be removed and stored  securely to prevent theft or loss. The following section describes the characteristics of using key servers for encryption and  essential advice for key server configuration with IBM Spectrum Virtualize and Storwize. Key servers have the following characteristics: Encryption key servers create and manage encryption keys that are used by the system. In  environments with a large number of systems, key servers distribute keys remotely without  requiring physical access to the systems. A key server is a centralized system that generates, stores, and sends encryption keys to the  system. If the key server provider supports replication of keys among multiple key servers,  you can specify up to 4 key servers (one master and three clones) that connect to the system  over both a public network or a separate private network. The system supports enabling encryption using an IBM Security Key Lifecycle Manager key  server. All key servers must be configured on the IBM Security Key Lifecycle Manager before  defining the key servers in the management GUI. IBM Security Key Lifecycle Manager  supports Key Management Interoperability Protocol (KMIP), which is a standard for  encryption of stored data and management of cryptographic keys.  IBM Security Key Lifecycle Manager can be used to create managed keys for the system and  provide access to these keys through a certificate. If you are configuring multiple key servers,  use IBM Security Key Lifecycle Manager 2.6.0.2 or later. The additional key servers (clones)  support more paths when delivering keys to the system; however, during rekeying only the  path to the primary key server is used. When the system is reeked, secondary key servers  are unavailable until the primary has replicated the new keys to these secondary key servers.  Replication must complete before keys can be used on the system. You can either schedule  automatic replication or complete it manually with IBM Security Key Lifecycle Manager.  During replication, key servers are not available to distribute keys or accept new keys. The  time a replication completes on the IBM Security Key Lifecycle Manager depends on the  number of key servers that are configured as clones and the amount of key and certificate  information that is being replicated.  4.6.4 Encryption at rest with key servers Key servers Chapter 4. Storage Pools  87