Quantum Scalar i6000, User Manual

Page: 335 / 738

Chapter 8: Encryption Key Management
Using SKM
Quantum Scalar i6000 User’s Guide 317
recipient. Each key contained in the file is encrypted using the public key
of the destination SKM server. The destination SKM server provides its
public key to the source SKM server as part of an Encryption Key
Certificate, which the source SKM server uses to wrap (encrypt) the
encryption keys for transport. Upon arrival, the file containing the
wrapped encryption keys can only be unwrapped by the corresponding
private key, which resides on the destination SKM server and is never
shared.
The process is as follows:
1 The destination administrator exports the Encryption Key Certificate
that belongs to the destination SKM server. The Encryption
Certificate is saved as a file to a location specified by the
administrator on a computer (see Exporting Encryption Certificates
on page 318).
2 The destination administrator e-mails the Encryption Key Certificate
file to the source administrator.
3 The source administrator saves the Encryption Key Certificate file to
a location on a computer, and then imports the Encryption Key
Certificate onto the source SKM server (see Importing Encryption
Certificates on page 317).
4 The source administrator exports the Encryption Keys, assigning the
same Encryption Key Certificate noted above to wrap the keys. The
file containing the wrapped encryption keys is saved to a location
on a computer specified by the source administrator. See Exporting
Encryption Keys on page 320.
5 The source administrator e-mails the file containing the wrapped
encryption keys to the destination administrator.
6 The destination administrator saves the file containing the wrapped
encryption keys to a location on a computer, and then imports the
keys onto the destination SKM server (see Importing Encryption
Keys).
7 The destination library can now read the encrypted tapes.
Importing Encryption Certificates
The encryption certificate contains a public key that is used to wrap
(encrypt) encryption keys prior to transporting them to another SKM
server. When sharing tape cartridges, or when performing a backup in