Quantum Scalar i40 Guida Utente Scaricare il pdf (Pagina 206)

Chapter 7: Encryption Key Management

About Key Reuse

178 Quantum Scalar i40 and Scalar i80 User’s Guide

Details about the Scalar i40 and Scalar i80 KMIP-compliant

implementation include:

• As with other encryption systems supported by the library, in order

to use KMIP-compliant encryption systems with the Scalar i40 or

Scalar i80, you must have an Encryption Key Management license

installed on the library.

• A minimum of two KMIP-compliant encryption servers are required

for failover purposes. A total of 10 KMIP-compliant encryption

servers are allowed, for increased failover capability.

• As of library firmware version i6 (160G), LTO-4, LTO-5 and LTO-6

tape cartridges that are encrypted using Library Managed

Encryption (LME) with a supported KMIP-encryption management

solution can only be decrypted using library firmware version i6 or

later. To check for newer library firmware versions, check the

Quantum Web site at

http://www.quantum.com/ServiceandSupport/

SoftwareandDocumentationDownloads/SI40/Index.aspx for more

information about compatible firmware.

About Key Reuse

When using Library Managed Encryption (LME) to encrypt data in library

partitions, you can choose to re-use encryption keys. Each time a tape

cartridge is mounted in a drive and data is written to the beginning of a

tape cartridge, a new key is retrieved from the Encryption Key

Management (EKM) server with which to encrypt the data. By default,

any previously used encryption keys are not reused and a brand new

encryption key is retrieved each time data is written to the beginning of

the tape. In large tape libraries where tapes are over-written repeatedly,

this scenario could require the maintenance of tens of thousands of

encryption keys being managed for only a small fraction of that number

of data tape cartridges. For example, if 10 tape cartridges are written

from the beginning of tape each day, then 3650 keys would be used to

encrypt 10 tapes after one year, 7300 would be used by the same 10

tapes after two years, and so on.

Key reuse allows the previously used encryption key to be used to re-

write the same tape, if the previously used key can be determined and

verified with the key server. If the tape is lost or security is compromised,

1 2 ... 201 202 203 204 205 206 207 208 209 210 211 ... 339 340

Nessun commento

Quantum Scalar i40 Guida Utente Pagina 206