HP StorageWorks 1/8 G2 Bedienungsanleitung

HP StorageWorks 1/8 G2 &

MSL Encryption Kit

getting started

The HP StorageWorks 1/8 G2 & MSL Encryption Kit

may be used with HP StorageWorks 1/8 G2 Tape

Autoloaders, and MSL2024, MSL4048, MSL8048,

and MSL8096 Tape Libraries with LTO-4 or later

generation tape drives. It is not compatible with

MSL6000 Tape Libraries.

Second edition: March 2010

The information in this document is subject to change without notice.

Printed in the US

www.hp.com

*AM495-96008*

CAUTION:

The key server token protects access to the encryption keys with

a personal identification number (PIN). If you lose the PIN, you

will NOT be able to restore data from your encrypted tapes.

Neither you nor HP can recover a lost PIN. Keep a copy of the

PIN in a safe place.

CAUTION:

The Encryption Kit includes two key server tokens. If one token

is lost or damaged, you will need the second token and the

encryption key backup file to restore data from your encrypted

tapes. HP recommends that you keep the second token in a safe

place. When you create new keys, HP recommends that you

keep a backup of the encryption keys in a safe place. Neither

you nor HP can generate the encryption key for a tape. You

will need a token, your encryption key backup file, and the

token PIN to access your encrypted data.

The Encryption Kit provides secure storage for encryption keys and access

to the encryption capability of the LTO-4 and later generation tape drives

without requiring encryption support in the backup application. The

Encryption Kit is designed to be used with manual processes for tracking

the correlation between tape cartridges and tokens. To restore data from

an encrypted tape cartridge, you must know which token has the

encryption key for the tape cartridge.

For more information about encryption, developing security processes

associated with the Encryption Kit, and operation of the Encryption Kit,

download the HP StorageWorks 1/8 G2 & MSL Encryption Kit user

guide from the HP website:

1. Browse to http://www.hp.com/support/tape.

2. In the Tape Storage and Media section, select Tape Libraries.

3. Select HP StorageWorks MSL2024 Tape Library.

4. In the Resources for HP StorageWorks MSL2024 Tape Library

section, select Manuals.

5. In the User guide section, select HP StorageWorks 1/8 G2 & MSL

Encryption Kit user guide.

1 Identifying product components

3. Product documentation1. Two key server tokens

2. Accessory bag of token id cards and holders

Page 1

2 Preparing the Autoloader or Library

The key server token and Autoloader or Library encryption capabilities

can only be configured from the web-based remote management interface

(RMI). Log into the RMI as the administrator user.

If you have not used the RMI on this Autoloader or Library in the past,

you must configure the network on the Autoloader or Library before

continuing.

See the Getting started guide that came with the Autoloader or Library,

or the User and service guide for instructions on configuring the network

and using the RMI. You can find these documents on the HP website at

http://www.hp.com/support/manuals.

Verify your Autoloader or Library firmware

version

Verify that the Autoloader or Library firmware version supports the

Encryption Kit. If you see the Configuration: Security tab in the RMI, the

firmware supports the Encryption Kit. If this tab is missing, update the

Autoloader or Library firmware to the current version.

You can download Autoloader or Library firmware files from the HP

Support website at http://www.hp.com/support.

Locate the USB port

Locate the USB port on the back panel of the Autoloader or Library.

If the USB port is covered with silver tape, remove the tape.

3 Preparing the key server tokens

As part of your security process, you will need to track each key server

token, along with information associated with the token, as required by

your security policy. If you do not have a security policy that specifies

this information, download the HP StorageWorks Encryption Kit User

guide from http://www.hp.com/support/tape for information about

creating your encryption key management processes. HP recommends

that you track at least:

•Token name

•Whether this token is a backup of another token

•Date range token was used for writing data

•The tape cartridges written with keys stored on the token. When

possible, record the barcode label associated with the tape cartridge.

•Token backup file filename and password. (See step 5.)

The Encryption Kit includes two methods of tracking the tokens. Choose

the approach that works best for your security policy and organization.

HP recommends that you use both approaches.

•Attached tag —The Encryption Kit includes a card and holder, which

can be used to attach information to the token.

•Serial number —Each key server token has a unique serial number.

You can use the serial number to identify the key server token and

correlate the tape cartridges written with keys on the token.

IMPORTANT:

HP recommends that you maintain a record of the tape

cartridges that are written with encryption keys on the key server

token. When restoring the data from an encrypted tape, you

will need to use the key server token containing the encryption

key for that tape. The name of the key server token is not stored

on the tape and the name of the tape is not stored on the key

server token. If you do not know which token contains the key

for a tape, you may need to try all of your key server tokens

when restoring data from an encrypted tape. Each key server

token can contain a maximum of 100 keys.

To use the attached tags to identify the tokens:

1. Write the token identification information on the paper cards.

2. Insert each card into a holder.

3. Attach the holders to the tokens.

4. Track the tape cartridges that are written with keys stored on the

token and keep a copy of this record in a secure location.

To use the serial numbers to identify the tokens:

•Record the token identification information and tape cartridges that

are written with keys stored on the token, and keep a copy of the

record in a secure location.

Page 2

TIP:

The serial number is on the bottom of the token when the token

is in the Autoloader or Library, making it difficult to see. You

can find the token serial number and firmware version from the

RMI Status: Security screen.

4 Configuring encryption

In this section, you will configure the name and personal information

number (PIN) for the key server token and configure encryption on the

Autoloader or Library.

Insert the key server token

Insert the key server token in the USB port on the back panel of the

Autoloader or Library.

Enter the PIN

When the key server token is inserted, the Autoloader or Library will

recognize it as a new token and display a dialog on the RMI requesting

that you enter a PIN. The new PIN must be at least eight characters long

and contain at least one capital letter, at least one lower case letter, and

at least two digits. Follow the directions in the dialog to enter your PIN.

Store a copy of the PIN in a secure location.

CAUTION:

The key server token protects the encryption keys with a personal

identification number (PIN). If you lose the PIN, you will not be

able to restore data from your encrypted tapes. Neither you

nor HP can recover a lost PIN. Keep a copy of the PIN in a safe

place.

Configure the encryption mode and features

From the Configuration: Security page you can enter the name of the

token, enable or disable encryption for the Autoloader or Library, and

enable the Autoloader or Library to automatically generate new keys. If

your Library has multiple partitions, you can enable or disable encryption

for each partition that contains an LTO-4 or later generation tape drive.

Only one encryption key is used at a time to write tape cartridges and

the same encryption key is used by all tape drives in the Library.

Enter the name of the token in the Token Name field.

By default, you must generate new keys manually. Optionally, you can

enable Automatic key generation to have the Autoloader or Library to

automatically generate a new key periodically. Set the generation time

and period in accordance with your security policy. Once a token

contains 100 keys you will need to obtain another token. Keys can never

be deleted from the token.

Enable encryption for the Autoloader or Library, or for one or more

logical libraries that contain an LTO-4 or later generation tape drive.

Click Submit.

NOTE:

The Library uses the same write encryption key (the Current key)

for all logical libraries with encryption enabled. If the Autoloader

or Library is writing an encrypted tape when you change the

security configuration, the new configuration will take effect for

the next tape loaded into an LTO-4 or later generation tape

drive.

Seeding the new key server token

When transitioning from a full token to a new token, you can copy the

highest numbered keys from the full token to the new token to enable

read operations from tapes written with keys on the full token.

Verify that no backup operations are in progress.

Log into the RMI Configuration: Security page.

Insert the full token into the USB port on the back of the Autoloader or

Library, and enter the PIN.

If the Number of Keys to Backup option is not visible, you must back up

all keys on the token to a file before creating a file with just some of the

keys. See the instructions in step 5 to back up the full token.

Page 3

In the Back up Token to File pane, enter a password, which will be used

to secure the data file on the computer, in both fields. The second one

ensures that the password was typed correctly.

Click Submit Token Backup File Password.

In the Number of Keys to Backup field, select the number of keys to copy

onto the new token. The highest-numbered keys, which are normally the

most recent, will be copied. For example, if the token has 100 keys and

you select 3, keys 98, 99, and 100 will be copied.

Click Save. The RMI will prompt you for the location to save the file.

Follow the instructions in the RMI.

Insert the new token into the USB port of the Autoloader or Library, and

enter the PIN.

Enter the password used to create the token backup file. Click Submit

Token Restore File Password.

Browse to the location of the token backup file containing the seed keys.

Click Restore. (The Browse button will be active after the token restore

file password is submitted.)

If you paused write operations at the beginning of the procedure, you

can resume them.

5 Backing up the token data

You can back up the keys on the token from the RMI Configuration:

Security page. Accessing the Configuration: Security page requires the

Administrator password. During the token backup process, the Autoloader

or Library will write the token information to a file in a secure format,

which will be saved on the computer from which you are running the

browser with the RMI. After the file is written, the information can be

restored to a different token.

Log into the Configuration: Security page.

In the Back up Token to File pane, enter a password, which will be used

to secure the data file on the computer, in both fields. The second one

ensures that the password was typed correctly.

Click Submit Token Backup File Password.

Click Save. The RMI will prompt you for the location to save the file.

Follow the instructions in the RMI.

After a power cycle

For increased security, the key server token's PIN is stored in volatile

memory in the Autoloader or Library. Each time the Autoloader or Library

is powered on, the PIN must be entered. The Autoloader or Library will

display a warning message on the OCP and RMI, and send periodic

SNMP and email events, if those options are enabled, until the PIN is

entered. The Autoloader or Library will not read or write encrypted data

until the PIN is entered.

CAUTION:

If it is critical that the Autoloader or Library maintain encryption

capability in the event of a power loss, HP recommends that

you plug the Autoloader's or Library's power cable into an

uninterruptable power supply (UPS).

Security status

The RMI Status: Security screen shows the encryption status for each of

the tape drives, along with information about the key server token. When

the Key Server Token Status is Token backup required, you should back

up the keys to a file and store the file in a safe place.

Helpful websites

For other product information, see the following websites:

http://www.hp.com/go/ebs

http://www.hp.com/go/tape

http://www.hp.com/go/storage

http://www.hp.com/support

http://www.hp.com/support/mslg3tstree

http://www.hp.com/support/TapeTools

http://www.docs.hp.com

http://www.hp.com

Page 4

Inhaltsverzeichnis

Andere HP Lagerung Handbücher

HP P6080-63001 - Maxtor DiamondMax Plus 40 GB Hard... Bedienungsanleitung

HP AJ765A - StorageWorks RDX Removable Disk Backup... Bedienungsanleitung

HP Xw4550 - Workstation - 2 GB RAM Bedienungsanleitung

HP D2D Bedienungsanleitung

HP StorageWorks 4000/6000/8000 - Enterprise Virtual... Bedienungsanleitung

HP StorageWorks Modular Smart Array 500 System Handbuch

HP StorageWorks 600 - Modular Disk System Handbuch

HP Surestore Disk Array 12h - And FC60 Bedienungsanleitung

HP StoreOnce D2D Backup System Gen2E Handbuch

HP StorageWorks 4000/6000/8000 - Enterprise Virtual... Bedienungsanleitung

HP StorageWorks 4400 Bedienungsanleitung

HP High-Performance Secure Hard Disk Bedienungsanleitung

HP StorageWorks P4000 Series Bedienungsanleitung

HP v229g Bedienungsanleitung

HP P9000 Bedienungsanleitung

HP StorageWorks MSL2024 Bedienungsanleitung

HP StorageWorks Ultrium 1760 Bedienungsanleitung

HP StorageWorks 4000/6000/8000 - Enterprise Virtual... Bedienungsanleitung

HP D7171A - NetServer - LPr Bedienungsanleitung

HP LeftHand P4000 - SAN Solutions Beilage

HP StoreOnce B6000 Bedienungsanleitung

HP X1800sb Bedienungsanleitung

HP 201723-B21 - HP StorageWorks Modular SAN Array 1000 Hard... Bedienungsanleitung

HP Surestore 1200ex - Optical Jukebox Bedienungsanleitung

Beliebte Lagerung Handbücher anderer Marken

QNAP

QNAP TS 32PXU Series Bedienungsanleitung

LaCie

LaCie RUGGED RAID Bedienungsanleitung

Freecom

Freecom CLS DOCK Bedienungsanleitung

PNY

PNY Attache P-FD64MBATT3 Bedienungsanleitung

OLT

OLT 6x6 Maximizer Bedienungsanleitung

Transcend

Transcend JetFlash 160 Bedienungsanleitung

LaCie

LaCie RUGGED MINI Bedienungsanleitung

Thunderbolt

Thunderbolt 600 Bedienungsanleitung

Panasonic

Panasonic LB-DH8 series Handbuch

Intel

Intel RAID High Availability Bedienungsanleitung

LaCie

LaCie 12big Thunderbolt 3 Bedienungsanleitung

Spectra Logic

Spectra Logic T-Series Spectra T50e Bedienungsanleitung

Panasonic

Panasonic LKM-F931-1 Bedienungsanleitung

Tabernus

Tabernus Enterprise Erase E2400 Bedienungsanleitung

Rocstor

Rocstor COMMANDER 3F series Bedienungsanleitung

Western Digital

Western Digital Ultrastar Data60 Bedienungsanleitung

Dell

Dell PowerVault MD3600f Series Bedienungsanleitung

CFI

CFI TERA STOR SATA RAID IV Bedienungsanleitung