User's Manual

ManualsBrandsQuantum ManualsNetwork RouterScalar i500

Document 6-01601-04, March 2010 1

Setting Up Quantum

Encryption Key Manager on

Your Scalar i500 Library

Quantum Encryption Key Manager (Q-EKM) is a Java software program that generates,

protects, stores, and manages encryption keys. These keys are used by IBM LTO-4 and

IBM LTO-5 tape drives to encrypt information being written to, and decrypt information

being read from, tape media. The encryption keys pass through the library; therefore

encryption is transparent to the applications.

Scalar i500 library support for Q-EKM is an optional, licensed feature that must be

enabled from the library in order to begin encrypting data using the IBM LTO tape drive

encryption capabilities.

For more information about the Q-EKM server and Q-EKM best practices, please refer to

the Quantum Encryption Key Manager User’s Guide.

Q-EKM Supported Tape Drives and Media 0

Q-EKM on the Scalar i500 supports encryption on LTO-4 and LTO-5 data cartridges using

IBM LTO-4 Fibre Channel tape drives, IBM LTO-4 SAS tape drives, and IBM LTO-5 Fibre

Channel tape drives. Q-EKM does not support encryption on other tape drive types or

manufacturer brands.

Caution: You must be running Q-EKM version 2.0 (or higher) to support

IBM LTO-5 tape drives.

Summary of content (8 pages)

PAGE 1
Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Quantum Encryption Key Manager (Q-EKM) is a Java software program that generates, protects, stores, and manages encryption keys. These keys are used by IBM LTO-4 and IBM LTO-5 tape drives to encrypt information being written to, and decrypt information being read from, tape media. The encryption keys pass through the library; therefore encryption is transparent to the applications.
PAGE 2
Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 Setting Up Q-EKM On the Library Step 1: Upgrade Firmware 0 Step 2: Install the License Key on the Library 0 0 Upgrade your library and tape drive firmware to the latest released versions. 1 Obtain a license key for encryption, following the instructions on the License Key Certificate you received. 2 Do one of the following: • From the operator panel, select Setup > Licenses.
PAGE 3
Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 5 Secure Sockets Layer (SSL): To enable SSL for communication between the library and the key servers, select the SSL Connection checkbox. The default is Disabled. If you enable SSL, you must make sure that the Primary and Secondary Key Server Port Numbers (see below) match the SSL port numbers set on the Q-EKM servers. The default SSL port number is 443.
PAGE 4
Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 Step 5: Configure Partition Encryption 0 Encryption on the Scalar i500 tape library is enabled by partition only. You cannot select individual tape drives for encryption; you must select an entire partition to be encrypted. Q-EKM partitions can only contain IBM LTO-4 and IBM LTO-5 tape drives. Caution: You must be running Q-EKM version 2.0 (or higher) to support IBM LTO-5 tape drives.
PAGE 5
Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 4 Click Apply. 5 Save the library configuration (for instructions, see the Scalar i500 User’s Guide). Run EKM Path Diagnostics0 Perform EKM Path Diagnostics as described in Using EKM Path Diagnostics on page 5. Using EKM Path Diagnostics 0 The EKM Path Diagnostics consists of a series of short tests to validate whether the key servers are running, connected, and able to serve keys as required.
PAGE 6
Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 The Manual diagnostics differs from the Automatic diagnostics in the following ways: • The Manual diagnostics takes affected partitions offline. • The Automatic diagnostics does not take partitions offline, but it may delay moves to tape drives while they are being tested. • The Manual diagnostics requires that you select one tape drive to use for the test.
PAGE 7
Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 Automatic EKM Path Diagnostics • If Completed appears in the Progress Window, the diagnostics were performed (this does not mean that the diagnostics passed, just that the diagnostics were performed). Click Close to close the Progress Window. • If Failure appears in the Progress Window, the diagnostics were not able to be performed.
PAGE 8
Setting Up Quantum Encryption Key Manager on Your Scalar i500 Library Document 6-01601-04 March 2010 Viewing Tape Drive Encryption Settings 0 You can view the encryption settings in the following ways: • System Information Report — To view encryption information on all key servers, partitions, and tape drives, select Reports > System Information from the web client. For more information, see the Scalar i500 User’s Guide.