HP AH164A - StorageWorks 1/8 G2 Tape Autoloader Ultrium... Bedienungsanleitung

HP StorageWorks 1/8 G2 &

MSL LTO-4 Encryption Kit

Getting started

The HP StorageWorks 1/8 G2 & MSL LTO-4

Encryption Kit may be used with HP StorageWorks

1/8 G2 Tape Autoloaders, and MSL2024, MSL4048,

and MSL8096 Tape Libraries. It may not be used with

MSL6000 Tape Libraries.

First edition: June 2008

The information in this document is subject to change without

notice.

Printed in the US

www.hp.com

AM495-96002

CAUTION:

The key server token protects access to the encryption keys with

apersonalidentiﬁcation number (PIN). If you lose the PIN, you

will NOT be able to restore data from your encrypted tapes.

NeitheryounorHPcanrecoveralostPIN.Keepacopyofthe

PIN in a safe place.

CAUTION:

The Encryption Kit includes two key server tokens. The second

token is intended as a backup for the ﬁrst token. When you

create new keys, HP recommends that you copy the new keys

tothebackuptokenandthenstorethebackuptokeninasafe

place. Even if you have the encryption token associated with the

tape, you will not be able to restore data from your encrypted

tapes without the token. Neither you nor HP can generate the

encryptionkeyforatapewithoutthetokenanditsPIN.

The HP StorageWorks 1/8 G2 & MSL LTO-4 Encryption Kit provides

secure storage for LTO-4 encryption keys and access to the encryption

capability of the LTO-4 tape drives without requiring encryption

support in the backup application. The Encryption Kit is designed to

be used with manual processes for tracking the correlation between

tape cartridges and tokens. To restore data from an encrypted tape

cartridge, you must know which token has the encryption key for the

tape cartridge.

For more information about encryption, developing security processes

associated with the Encryption Kit, and operation of the Encryption Kit,

download the HP StorageWorks 1/8 G2 & MSL LTO-4 Encryption Kit

user guide from the HP website:

1. Browse to http://www.hp.com/support/tape.

2. In the Tape Storage and Media section, select Tape Libraries.

3. Select HP StorageWorks MSL2024 Tape Library.

4. In the Resources for HP StorageWorks MSL2024 Tape Library

section, select Manuals.

5. In the User guide section, select HP StorageWorks 1/8 G2 & MSL

LTO-4 Encryption Kit user guide.

1Identifying product components

11867

1. Tw o k e y s e r v e r t o k e n s

2. Bag of holders and cards

3. Product documentation

Page 1

2 Preparing the Autoloader or Library

The key server token and Autoloader or Library encryption capabilities

can only be conﬁgured from the web-based remote management

interface (RMI). Log into the RMI as the administrator user.

If you have not used the RMI on this Autoloader or Library in the past,

you must conﬁgure the network on the Autoloader or Library before

continuing.

See the Getting started guide that came with the Autoloader or Library,

or the User and service guide on the documentation CD for instructions

on conﬁguring the network and using the RMI. You can also ﬁnd these

documents on the HP website at http://www.hp.com/support/manuals.

Verify your Autoloader or Library ﬁrmware

version

Verify that the Autoloader or Library ﬁrmware version supports the

Encryption Kit. If you see the Conﬁguration: Security tab in the RMI, the

ﬁrmware supports the Encryption Kit. If this tab is missing, update the

Autoloader or Library ﬁrmware to the current version.

You can download Autoloader or Library ﬁrmware ﬁlesfromtheHP

Support website at http://www.hp.com/support.

Locate the USB port

11868

Locate the USB port on the back panel of the Autoloader or Library.

If the USB port is covered with silver tape, remove the tape.

3 Preparing the key server tokens

As part of your security process, you will need to track each key server

token, along with information associated with the token, as required by

your security policy. If you do not have a security policy that speciﬁes

this information, download the HP StorageWorks Encryption Kit User

guide from http://www.hp.com/support/tape for information about

creating your encryption key management processes. HP recommends

that you track at least:

•Token name

•Datesusedforwritingdata

•The tape cartridges written with keys stored on the token. When

possible, record the barcode label associated with the tape

cartridge.

The Encryption Kit includes two methods of tracking the tokens. Choose

the approach that works best for your security policy and organization.

HP recommends that you use both approaches.

•Attached tag — The Encryption Kit includes a card and holder,

which can be used to attach information to the token.

•Serial number — Each key server token has a unique serial number.

You can use the serial number to identify the key server token and

correlatethetapecartridgeswrittenwithkeysonthetoken.

IMPORTANT:

HP recommends that you maintain a record of the tape cartridges

that are written with encryption keys on the key server token.

When restoring the data from an encrypted tape, you will need

to use the key server token containing the encryption key for that

tape. The name of the key server token is not stored on the tape

and the name of the tape is not stored on the key server token.

Ifyoudonotknowwhichtokencontainsthekeyforatape,you

may need to try all of your key server tokens when restoring data

from an encrypted tape.

To use the attached tags to identify the tokens:

1. Write the token identiﬁcation information on the paper cards.

2. Insert each card into a holder.

3. Attach the holders to the tokens.

4.Track the tape cartridges that are written with keys stored on the

tokenandkeepacopyofthisrecordinasecurelocation.

To use the serial numbers to identify the tokens:

•Record the token identiﬁcation information and tape cartridges

that are written with keys stored on the token, and keep a copy of

the record in a secure location.

TIP:

The serial number is on the bottom of the token when the token is

in the Autoloader or Library, making it difﬁcult to see. You can

ﬁnd the token serial number from the RMI Status: Security screen.

Page 2

4Conﬁguring encryption

In this section, you will conﬁgure the name and personal information

number (PIN) for the key server token and conﬁgure encryption on the

Autoloader or Library.

Insert the key server token

11869

InsertthekeyservertokenintheUSBportonthebackpanelofthe

Autoloader or Library.

Enter the PIN

When the key server token is inserted, the Autoloader or Library will

recognize it as a new token and display a dialog on the RMI requesting

that you enter a PIN. The new PIN must be at least eight characters long

and contain at least one capitol letter, at least one lower case letter, and

at least two digits. Follow the directions in the dialog to enter your PIN.

Store a copy of the PIN in a secure location.

CAUTION:

The key server token protects the encryption keys with a personal

identiﬁcation number (PIN). If you lose the PIN, you will not be

able to restore data from your encrypted tapes. Neither you nor

HP can recover a lost PIN. Keep a copy of the PIN in a safe place.

Conﬁguretheencryptionmodeandfeatures

From the Conﬁguration: Security page you can enter the name of

thetoken,enableordisableencryptionfortheAutoloaderorLibrary,

and enable the Autoloader or Library to automatically generate new

keys. If your Library has multiple partitions, you can enable or disable

encryption for each partition that contains an LTO-4 tape drive. Only

one encryption key is used at a time to write tape cartridges and the

same encryption key is used by all tape drives in the Library.

Enter the name of the token in the Token Name ﬁeld.

By default, you must generate new keys manually. Optionally, you can

enable Automatic key generation to have the Autoloader or Library to

automatically generate a new key periodically. Set the generation time

and period in accordance with your security policy.

Enable encryption for the Autoloader or Library, or for one or more

logical libraries that contain an LTO-4 tape drive.

Click Submit.

NOTE:

The Autoloader or Library can only use one encryption key at a

time, for all tape drives in all logical libraries. If the Autoloader

or Library is writing an encrypted tape when you change the

security conﬁguration, the new conﬁguration will take effect for

the next tape loaded into an LTO-4 tape drive.

Page 3

5Backingupthekeyservertoken

The Encryption Kit includes two key server tokens so you can make a

copyofthekeyservertokenandstoreoneofthetokensinasafeplace.

The token copy process synchronizes the keys on the two tokens and

does not distinguish between a master and backup token.

CAUTION:

When you create new keys, HP recommends that you copy the

new keys to the second token and then store one of the tokens

in a safe place. You will not be able to restore data from your

encrypted tapes without the token with the encryption key for the

tape. Neither you nor HP can generate the encryption key from a

tape without the token.

During the copy process, the two tokens will need to be exchanged

several times.

To start thecopyprocess,intheConﬁguration: Security screen, click

Start TokenBackup. Follow the instructions on the RMI.

After the backup process is complete, leave one of the key server tokens

in the Autoloader or Library USB port.

Store the second key server token in a secure location.

CAUTION:

ThetokenmustbeintheAutoloader’sorLibrary’sUSBport

for the device to read or write encrypted data. If the token is

dislodgedorremoved,yourbackupscouldfail.Ifthetokenislost,

you will not be able to restore the data from your encrypted tapes

unless you have a backup token.

After a power cycle

Forincreasedsecurity,thekeyservertoken’sPINisstoredinvolatile

memoryintheAutoloaderorLibrary. EachtimetheAutoloaderor

Library is powered on, the PIN must be entered. The Autoloader or

Library will display a warning message on the OCP and RMI, and send

periodic SNMP and email events, if those options are enabled, until

the PIN is entered. The Autoloader or Library will not write encrypted

data until the PIN is entered.

CAUTION:

If it is critical that the Autoloader or Library maintain encryption

capability in the event of a power loss, HP recommends that

you plug the Autoloader’s or Library’s power cable into an

uninterruptible power supply (UPS).

Security status

The Security Status icon on System Status pane on the left side of the RMI

indicates when keys need to be backed up to another key server token.

The RMI Status: Security screen shows the encryption status for each of

the tape drives, along with information about the key server token.

Helpful websites

For other product information, see the following websites:

http://www.hp.com/go/ebs

http://www.hp.com/go/tape

http://www.hp.com/go/storage

http://www.hp.com/support

http://www.hp.com/support/mslg3tstree

http://www.hp.com/support/TapeTools

http://www.docs.hp.com

http://www.hp.com

Page 4

Andere Handbücher für AH164A - StorageWorks 1/8 G2 Tape Autoloader Ultrium...

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere HP Lagerung Handbücher

HP AA988A - Modular Smart Array Storage Controller... Bedienungsanleitung

HP VS160 - StorageWorks DLT Tape Drive Betriebsanleitung

HP 3PAR StoreServ 7200 2-node Bedienungsanleitung

HP 6100 Kurzanleitung

HP M8501 Bedienungsanleitung

HP StorageWorks XP1024 Kurzanleitung

HP StorageWorks 4000/6000/8000 - Enterprise Virtual... Bedienungsanleitung

HP LTO-2 HH Bedienungsanleitung

HP Ultrium Drive Produkthandbuch

HP Ultrium 1840 Bedienungsanleitung

HP A5272A - SureStore E Disk System SC10 Storage... Bedienungsanleitung

HP StoreEver MSL2024 Gebrauchsanweisung

HP D2D100 Bedienungsanleitung

HP nimblestorage CS235 Bedienungsanleitung

HP StorageWorks 300 - Virtual Library System EVA... Bedienungsanleitung

HP StorageWorks 2000i Bedienungsanleitung

HP StorageWorks MSL5000 series Bedienungsanleitung

HP StorageWorks P4000 Series Bedienungsanleitung

HP Surestore 6164 - Switch Bedienungsanleitung

HP v275w Bedienungsanleitung

HP P9000 Bedienungsanleitung

HP StorageWorks 2000fc Bedienungsanleitung

HP STORAGEWORKS ALL-IN-ONE STORAGE SYSTEM Bedienungsanleitung

Beliebte Lagerung Handbücher anderer Marken

QNAP

QNAP TS 32PXU Series Bedienungsanleitung

LaCie

LaCie RUGGED RAID Bedienungsanleitung

Freecom

Freecom CLS DOCK Bedienungsanleitung

PNY

PNY Attache P-FD64MBATT3 Bedienungsanleitung

OLT

OLT 6x6 Maximizer Bedienungsanleitung

Transcend

Transcend JetFlash 160 Bedienungsanleitung

LaCie

LaCie RUGGED MINI Bedienungsanleitung

Thunderbolt

Thunderbolt 600 Bedienungsanleitung

Panasonic

Panasonic LB-DH8 series Handbuch

Intel

Intel RAID High Availability Bedienungsanleitung

LaCie

LaCie 12big Thunderbolt 3 Bedienungsanleitung

Spectra Logic

Spectra Logic T-Series Spectra T50e Bedienungsanleitung

Panasonic

Panasonic LKM-F931-1 Bedienungsanleitung

Tabernus

Tabernus Enterprise Erase E2400 Bedienungsanleitung

Rocstor

Rocstor COMMANDER 3F series Bedienungsanleitung

Western Digital

Western Digital Ultrastar Data60 Bedienungsanleitung

Dell

Dell PowerVault MD3600f Series Bedienungsanleitung

CFI

CFI TERA STOR SATA RAID IV Bedienungsanleitung