A separate key server for encrypting data at rest. It is mandatory with SEDs and dual encryption, and optional for software-only encryption as an alternative to Native KMS.
Also called external key management server.
Read more: Nutanix docs
In the Ultra Transcenders books
Each book explains External KMS in context, with comparison tables and the common traps.
Terms in this definition
- Index field attributes
Settings applied to each field in an Azure AI Search index:
searchablefor full text,retrievableto return it,filterablefor exact-match$filter,sortable,facetablefor counts, andkeyfor the unique document ID. - Data at rest
Information sitting in storage, whether on a disk, in a database or in a storage account. By default, Azure keeps such data encrypted.
- Encryption
Scrambling data so it cannot be read without the correct secret key, which is then used to turn it back again. Hashing, by contrast, cannot be reversed.
- Software-only encryption
Encryption of stored data by AOS itself, using AES-256 without special drives, with keys held in Native KMS or an external KMS. Enabling it is permanent.
- Native KMS
The key manager built into Nutanix for software-only encryption. It runs locally on clusters of three or more nodes, or remotely through a registered Prism Central, usually for ROBO clusters of one or two nodes.
Related terms
- Key Management Server
Stores encryption keys protecting Nutanix data at rest. Options are External KMS, Cloud KMS, or Native KMS in a local or remote form.
- vSphere Native Key Provider
Built into vCenter, this provider generates encryption keys itself, so no external KMS is needed; back it up before first use.