IBM System Storage TS2900, Setup, Operator, And Service Manual

Page: 67 / 257

Chapter 3. Installation and Configuration
3-23
Figure 3-24. Encryption enabled settings
To modify the encryption settings, complete the following procedure:
1. Expand Configure Library , if necessary, and click on Encryption in the left
navigation pane of the Web User Interface.
2. Enter the Encryption Activation Key and click Submit to enable encryption in
your library.
3. Select the Security Settings.
• Enable SSL for EKM — Select to enable secure communications between the
tape library and the EKM server.
4. Select the Encryption method settings.
• Application Managed Encryption — For encryption in operating
environments that run an application capable of generating and managing
encryption policies and keys. If you select application-managed encryption, no
further configuration steps are necessary.
• System Managed Encryption — For encryption in operating environments
where no application is capable of key management runs, and encryption is set
up implicitly through each instance of the IBM device driver.
• Library Managed Encryption — For transparent encryption by the TS2900
Tape Autoloader tape drive.
Note: System managed tape encryption and library managed tape encryption
are transparent to one another. A tape encrypted using system managed
encryption may be decrypted using library managed encryption, and vice
versa, provided both have access to the same EKM keystore.
5. Select the Primary EKM Server Settings ( library-managed encryption only ) — The
address of the primary encryption key manager on a server. IPv4 and IPv6
addresses are supported. Hostnames can be entered instead of numerical IP
addresses if the DNS server is specified.
•
Address — The IP address of the primary encryption key manager.
• TCP port number — The port number of the primary encryption key manager
for TCP. The default port number is 3801.
a29z0171