Getting Started Guide

ManualsBrandsHP Manualscomputers & electronicsMSL6480

HP 1/8 G2 Tape Autoloader

and MSL Tape Library

Encryption Kit Getting Started

Abstract

The HP 1/8 G2 Tape Autoloader and MSL Tape Library

Encryption Kit may be used with HP StoreEver 1/8 G2 Tape

Autoloaders, and MSL2024, MSL4048, MSL6480,

MSL8048, and MSL8096 Tape Libraries with LTO-4 or later

generation tape drives. It is not compatible with MSL6000

Tape Libraries.

Printed in the US

*AM495-96030*

HP Part Number: AM495-96030

Published: June 2013

Edition: Third

CAUTION: The key server token protects

access to the encryption keys with a personal

identification number (PIN). If you lose the PIN,

you will NOT be able to restore data from your

encrypted tapes. Neither you nor HP can

recover a lost PIN. Keep a copy of the PIN in a

safe place.

CAUTION: The encryption kit includes two key

server tokens. If one token is lost or damaged,

you will need the second token and the

encryption key backup file to restore data from

your encrypted tapes. HP recommends that you

keep the second token in a safe place. When

you create new keys, HP recommends that you

keep a backup of the encryption keys in a safe

place. Neither you nor HP can generate the

encryption key for a tape. You will need a

token, your encryption key backup file, and the

token PIN to access your encrypted data.

The encryption kit provides secure storage for

encryption keys and access to the encryption capability

of the LTO-4 and later generation tape drives without

requiring encryption support in the backup application.

The encryption kit is designed to be used with manual

processes for tracking the correlation between tape

cartridges and tokens. To restore data from an

encrypted tape cartridge, you must know which token

has the encryption key for the tape cartridge.

For more information about encryption, developing

security processes associated with the encryption kit,

and operation of the encryption kit, download the HP

1/8 G2 Tape Autoloader and MSL Tape Library

Encryption Kit User Guide from the HP website:

1. Browse to http://www.hp.com/support/tape.

2. In the Tape Storage section, select Tape Libraries.

3. Select HP StoreEver MSL Tape Libraries.

4. In the Resources for HP StoreEver MSL Tape

Libraries section, select Manuals.

5. In the User guide section, select

HP 1/8 G2 Tape

Autoloader and MSL Tape Library Encryption Kit

User Guide

Page 1

Summary of content (6 pages)

PAGE 1
HP 1/8 G2 Tape Autoloader and MSL Tape Library Encryption Kit Getting Started CAUTION: The key server token protects access to the encryption keys with a personal identification number (PIN). If you lose the PIN, you will NOT be able to restore data from your encrypted tapes. Neither you nor HP can recover a lost PIN. Keep a copy of the PIN in a safe place. Abstract CAUTION: The encryption kit includes two key server tokens.
PAGE 2
missing, update the autoloader or library firmware to the current version. 1 Identifying product components You can download autoloader or library firmware files from the HP Support website at http://www.hp.com/ support. 1 Locate the USB port Locate the USB port on the back panel of the autoloader or library. 3 MSL6480 2 11867 1. Two key server tokens 2. Accessory bag of token id cards and holders 3.
PAGE 3
. 4. Attach the holders to the tokens. Track the tape cartridges that are written with keys stored on the token and keep a copy of this record in a secure location. To use the serial numbers to identify the tokens: • Record the token identification information and tape cartridges that are written with keys stored on the token, and keep a copy of the record in a secure location.
PAGE 4
Autoloader and other libraries Enter the PIN When the key server token is inserted, the autoloader or library will recognize it as a new token and display a dialog on the RMI requesting that you enter a PIN. The new PIN must be between 8 and 16 characters long and contain at least one capital letter, at least one lower case letter, and at least two digits. Follow the directions in the dialog to enter your PIN.
PAGE 5
Seeding the new key server token Backing up the token data When transitioning from a full token to a new token, you can copy the highest numbered keys from the full token to the new token to enable read operations from tapes written with keys on the full token. You can back up the keys on the token from the RMI, which requires the administrator password.
PAGE 6
After a power cycle Helpful websites For increased security, the key server token's PIN is stored in volatile memory in the autoloader or library. Each time the autoloader or library is powered on, the PIN must be entered. The autoloader or library will display a warning message on the OCP and RMI, and send periodic SNMP and email events, if those options are enabled, until the PIN is entered. The autoloader or library will not read or write encrypted data until the PIN is entered.