Administrator's Guide Supporting RSA Data Protection Manager (DPM) Environments (Supporting Fabric OS v7.2.0) Owner's manual

Fabric OS Encryption Administrator’s Guide (DPM) 235
53-1002922-01
Tape data compression
5
Tape data compression
Data is compressed by the encryption switch or blade before encrypting only if the tape device
supports compression, and compression is explicitly enabled by the host backup application. That
means if the tape device supports compression, but is not enabled by the host backup application,
then compression is not performed by the encryption switch or blade before encrypting the data.
However, if the backup application turns on compression at the tape device and does not turn it off
before logout or after the backup or restore operation is complete, and a second host backup
application starts using the same tape device and does not explicitly turn off compression,
compression will still be on when the encryption switch or blade issues a Mode Sense command to
find target device capabilities, and compression is used. In other words, if the host backup
application does not turn off compression on the target, the encryption switch or blade uses the
compression feature of the target. Conversely, if the tape device does not support compression,
the encryption switch or blade does not perform compression before encrypting the data. The
same rules apply for decompression.
Data is compressed, encrypted and padded with ASCII 0 to the tape block length to simplify
handling at the encryption device. It is assumed that a tape target with compression enabled will
be unable to compress the seemingly random encrypted data, but will greatly compress the
padded zero data that follows. Compressing data at the encryption device in conditions other than
above does not create any additional space savings on the tape media.
Tape pools
When a new tape pool needs to be created, the following steps must be performed:
• Configure the tape pool with a maximum of 64 bytes of tape pool label first on the encryption
device. The tape pool label configured on the encryption device must be an exact match to the
tape pool label (or number) configured on the tape backup application.
• Set the policies (such as encrypt or cleartext), format (such as native Brocade format or
DF-compatible), and optionally specify a key life span for the tape pool.
Tape pools are unique across an encryption group. Tape pool configuration takes precedence over
LUN level configuration.
Tape pool configuration is used only when labeling of tape media is done on the first write for the
tape media. After tape labeling is done and metadata written, the tape pool configuration is no
longer used. Tape pool configuration is not required for restoring data from the encrypted tape
belonging to the tape pool, because the key ID is present in the metadata.
When the tape pool label configured on the encryption device does not match with any label that
the backup application sends as part of the first write (tape labeling) to the tape media, the tape
pool level policies are ignored and default LUN level policies are applied.