IBM System Storage TS3500, Introduction And Planning Manual

Page: 240 / 290

How and where these rules are set up depends on the operating environment.
See “Managing encryption” for more information.
Note: In the tape storage environment, the encryption function on tape drives
(desktop, stand alone and within libraries) is configured and managed by the
customer and not the IBM System Services Representative (SSR). In some instances
SSRs are required to enable encryption at a hardware level when service access or
service password controlled access is required. Customer setup support is by Field
Technical Sales Specialist (FTSS), customer documentation, and software support
for encryption software problems. Customer “how to” support is also provided via
support line contract.
Managing encryption
This topic introduces the key manager and the three methods for managing
encryption in the TS3500 Tape Library.
A key manager is a software program that assists IBM encryption-enabled tape
drives in generating, protecting, storing, and maintaining encryption keys that are
used to encrypt information being written to, and decrypt information being read
from, tape media (tape and cartridge formats). IBM currently supports the IBM
Encryption Key Manager component for the Java platform or the Tivoli Key
Lifecycle Manager with the TS3500 Tape Library. The key manager operates on
z/OS
®
, i5/OS, AIX, Linux, HP-UX, Sun Solaris, and Windows, and is designed to
be a shared resource deployed in several locations within an Enterprise. It is
capable of serving numerous IBM encrypting tape drives, regardless of where
those drives reside (for example, in tape library subsystems, connected to
mainframe systems through various types of channel connections, or installed in
other computing systems.)
The key manager uses a keystore to hold the certificates and keys (or pointers to
the certificates and keys) required for all encryption tasks. Refer to the appropriate
key manager documentation for detailed information about the key manager and
the keystores it supports.
There are three methods of encryption management to choose from. These methods
differ in where the encryption policy engine resides and where key management is
performed for your encryption solution, and how the key manager is connected to
the drive. Your operating environment determines which is the best for you. Key
management and the encryption policy engine may be located in any one of the
following three environmental layers.
216
IBM System Storage TS3500 Tape Library with ALMS: Introduction and Planning Guide