Citibank: Add 2 more EKMs entries on the data at rest page on the MI so that we can add 2 IP’s and Ports for SKLM and 2 IP’s and Ports for GKLM (Different Key Servers for Tape and Disk)

CITI is planning to leverage external encryption for their TS7700 systems as part of their long-term data security strategy. Currently, the Management Interface (MI) on TS7700 only allows for the configuration of a single set of IP addresses and ports for integration with either IBM Security Key Lifecycle Manager (SKLM) or Guardium Key Lifecycle Manager (GKLM).

However, based on the latest feedback from Simon Yang (Citibank contact), CITI is not in a position to consolidate SKLM and GKLM infrastructure in the near future (estimated 3-5 years). This limitation poses a challenge, as TS7700s would either require:

Merging SKLM and GKLM servers – a scenario which IBM has not validated and may introduce risk or compatibility concerns, or

An MI enhancement to support configuring both SKLM and GKLM endpoints independently.

To address this need, CITI is requesting an enhancement to the MI's Data-at-Rest configuration page to allow the entry of two sets of IP addresses and ports:

Two (2) IPs and ports for SKLM

Two (2) IPs and ports for GKLM

This would enable redundant, production-grade encryption key management using both systems without requiring unsupported consolidation. The enhancement would provide greater flexibility and help future-proof TS7700 deployments in complex enterprise environments with heterogeneous key management systems.

Business Impact:
This change is critical to enabling CITI’s planned encryption architecture without requiring infrastructure changes that may not be feasible for several years. Supporting dual key manager endpoints will enable secure and highly available encryption key access, aligning with enterprise compliance and security policies.

Request Origin:
CITI, via discussion with Ramon Minjares Campos (IBM)
Prepared for potential discussion in upcoming Thursday meeting.