Quantum Q-EKM User's Guide

Quantum Encryption Key Manager6-01847-02Quantum Encryption Key ManagerScalar Libraries5SERS'UIDE5SERS'UIDE5SERS'UIDE5SERS&ap

Quantum Encryption Key Manager User’s Guide xThis manual also uses the following conventions:Related DocumentsThe following publications provide infor

Quantum Encryption Key Manager User’s Guide xiContactsQuantum company contacts are listed below.Quantum Corporate Headquarters0To order documentation

Quantum Encryption Key Manager User’s Guide xii• eSupport – Submit online service requests, update contact information, add attachments, and receive s

Quantum Encryption Key Manager User’s Guide xiii

Quantum Encryption Key Manager User’s Guide 1Chapter 11OverviewData is one of the most highly valued resources in a competitive business environment.

OverviewLibrary Managed EncryptionQuantum Encryption Key Manager User’s Guide 2Library Managed EncryptionThe library managed tape drive encryption sol

OverviewManaging Encryption With Q-EKMQuantum Encryption Key Manager User’s Guide 3Library managed encryption is provided for IBM LTO-4 and LTO-5 tape

OverviewQuantum Encryption Key Manager (Q-EKM) ComponentsQuantum Encryption Key Manager User’s Guide 4Quantum Encryption Key Manager (Q-EKM) Component

OverviewQuantum Encryption Key Manager (Q-EKM) ComponentsQuantum Encryption Key Manager User’s Guide 5Keystore 1The keystore is defined as part of th

OverviewEncryption KeysQuantum Encryption Key Manager User’s Guide 6Configuration Files 1The configuration files contain the configuration information

Quantum Encryption Key Manager User’s Guide, 6-01847-02, Rev A, August 2010. Product of USA.Quantum Corporation provides this publication “as is” with

OverviewEncryption KeysQuantum Encryption Key Manager User’s Guide 7Q-EKM uses two types of encryption algorithms: • Symmetric • Asymmetric Symmetric,

OverviewEncryption CertificatesQuantum Encryption Key Manager User’s Guide 8Encryption CertificatesEach Q-EKM server pair uses one unique encryption c

Quantum Encryption Key Manager User’s Guide 9Chapter 22Planning Your Q-EKM EnvironmentUse the information in this chapter to determine the best Q-EKM

Planning Your Q-EKM EnvironmentSystem RequirementsQuantum Encryption Key Manager User’s Guide 10• The Q-EKM server must have IP connectivity through a

Planning Your Q-EKM EnvironmentUsing Multiple Q-EKM Servers for RedundancyQuantum Encryption Key Manager User’s Guide 11Supported Media 2Q-EKM support

Planning Your Q-EKM EnvironmentQ-EKM Server ConfigurationsQuantum Encryption Key Manager User’s Guide 12Q-EKM Server Configurations Q-EKM can be insta

Planning Your Q-EKM EnvironmentQ-EKM Server ConfigurationsQuantum Encryption Key Manager User’s Guide 13Figure 2 Single Q-EKM Server Two-Server Confi

Planning Your Q-EKM EnvironmentMultiple Libraries Accessing One Q-EKM Server or Server PairQuantum Encryption Key Manager User’s Guide 14importing cer

Planning Your Q-EKM EnvironmentBacking Up Keystore and Configuration DataQuantum Encryption Key Manager User’s Guide 15• Each library can only be conf

Planning Your Q-EKM EnvironmentDisaster Recovery PlanningQuantum Encryption Key Manager User’s Guide 16Disaster Recovery PlanningQuantum recommends th

Quantum Encryption Key Manager User’s Guide iiiContentsPreface viiiChapter 1 Overview 1Library Managed Encryption...

Quantum Encryption Key Manager User’s Guide 17Chapter 33Tips for SuccessDo these things to ensure optimal performance and successful recovery in case

Tips for SuccessQuantum Encryption Key Manager User’s Guide 18• Back up your keystore and configuration files regularly. In case of catastrophic serve

Quantum Encryption Key Manager User’s Guide 19Chapter 44Upgrading Q-EKMUpgrading updates the Q-EKM software to the latest version, preserving your key

Upgrading Q-EKMQuantum Encryption Key Manager User’s Guide 201 Stop all host I/O communication to the Q-EKM server. 2 On all libraries that access the

Upgrading Q-EKMQuantum Encryption Key Manager User’s Guide 215 Insert the upgrade CD into your Q-EKM server’s CD ROM drive. If the CD does not autorun

Upgrading Q-EKMQuantum Encryption Key Manager User’s Guide 229 If the Q-EKM server is running, you are prompted for the Q-EKM admin password. Enter th

Upgrading Q-EKMQuantum Encryption Key Manager User’s Guide 2318 Make a copy of the keystore and configuration files and store these in a secure locati

Quantum Encryption Key Manager Service and Installation Manual 24Chapter 55Q-EKM Server Operation and ConfigurationThis chapter details the Q-EKM pass

Chapter 5 Q-EKM Server Operation and ConfigurationOverviewQuantum Encryption Key Manager Service and Installation Manual 25OverviewOnce installed, Q-

Chapter 5 Q-EKM Server Operation and ConfigurationUsing and Changing PasswordsQuantum Encryption Key Manager Service and Installation Manual 26Changi

Quantum Encryption Key Manager User’s Guide ivSupported Libraries and Tape Drives ... 10Supported Medi

Chapter 5 Q-EKM Server Operation and ConfigurationLogging On to Q-EKM CommandsQuantum Encryption Key Manager Service and Installation Manual 27The ke

Chapter 5 Q-EKM Server Operation and ConfigurationLogging On to Q-EKM CommandsQuantum Encryption Key Manager Service and Installation Manual 282 Navi

Chapter 5 Q-EKM Server Operation and ConfigurationQ-EKM Server CommandsQuantum Encryption Key Manager Service and Installation Manual 29Figure 5 Q-E

Chapter 5 Q-EKM Server Operation and ConfigurationQ-EKM Server CommandsQuantum Encryption Key Manager Service and Installation Manual 30Displaying th

Chapter 5 Q-EKM Server Operation and ConfigurationTurning Debug Logging On and OffQuantum Encryption Key Manager Service and Installation Manual 312

Chapter 5 Q-EKM Server Operation and ConfigurationTurning Debug Logging On and OffQuantum Encryption Key Manager Service and Installation Manual 32be

Chapter 5 Q-EKM Server Operation and ConfigurationSynchronizing Primary and Secondary Q-EKM ServersQuantum Encryption Key Manager Service and Install

Chapter 5 Q-EKM Server Operation and ConfigurationSynchronizing Primary and Secondary Q-EKM ServersQuantum Encryption Key Manager Service and Install

Chapter 5 Q-EKM Server Operation and ConfigurationSynchronizing Primary and Secondary Q-EKM ServersQuantum Encryption Key Manager Service and Install

Chapter 5 Q-EKM Server Operation and ConfigurationKeeping the Keystores MatchedQuantum Encryption Key Manager Service and Installation Manual 368 Pre

Quantum Encryption Key Manager User’s Guide vChapter 6 Sharing Encrypted Tapes – Import/Export Operations 39Sharing Encrypted Tape Cartridges...

Chapter 5 Q-EKM Server Operation and ConfigurationChanging the Communication Port SettingsQuantum Encryption Key Manager Service and Installation Man

Chapter 5 Q-EKM Server Operation and ConfigurationChanging the Communication Port SettingsQuantum Encryption Key Manager Service and Installation Man

Quantum Encryption Key Manager User’s Guide 39Chapter 66Sharing Encrypted Tapes – Import/Export Operations This chapter covers:• Sharing Encrypted Tap

Sharing Encrypted Tapes – Import/Export OperationsSharing Encrypted Tape CartridgesQuantum Encryption Key Manager User’s Guide 40Q-EKM creates unique

Sharing Encrypted Tapes – Import/Export OperationsSpecial Considerations for Exchanging Files Between Linux and Windows ServersQuantum Encryption Key

Sharing Encrypted Tapes – Import/Export OperationsWhy You Should Not Change File NamesQuantum Encryption Key Manager User’s Guide 42case, the recipien

Sharing Encrypted Tapes – Import/Export OperationsExporting the Public CertificateQuantum Encryption Key Manager User’s Guide 43The reasons you should

Sharing Encrypted Tapes – Import/Export OperationsExporting the Public CertificateQuantum Encryption Key Manager User’s Guide 44Figure 7 Key Import/E

Sharing Encrypted Tapes – Import/Export OperationsImporting a Public CertificateQuantum Encryption Key Manager User’s Guide 458 If you changed the def

Sharing Encrypted Tapes – Import/Export OperationsImporting a Public CertificateQuantum Encryption Key Manager User’s Guide 467 Possible Step: You may

Quantum Encryption Key Manager User’s Guide viAppendix A Setting the System Path Variable in Windows 74Glossary 75Index 78

Sharing Encrypted Tapes – Import/Export OperationsExporting Data Encryption KeysQuantum Encryption Key Manager User’s Guide 47The keystore file is cal

Sharing Encrypted Tapes – Import/Export OperationsExporting Data Encryption KeysQuantum Encryption Key Manager User’s Guide 485 Enter your keystore pa

Sharing Encrypted Tapes – Import/Export OperationsExporting Data Encryption KeysQuantum Encryption Key Manager User’s Guide 499 Send the data encrypti

Sharing Encrypted Tapes – Import/Export OperationsExporting Data Encryption KeysQuantum Encryption Key Manager User’s Guide 505 Enter your keystore pa

Sharing Encrypted Tapes – Import/Export OperationsExporting Data Encryption KeysQuantum Encryption Key Manager User’s Guide 51You are asked to enter o

Sharing Encrypted Tapes – Import/Export OperationsImporting Data Encryption KeysQuantum Encryption Key Manager User’s Guide 52If you change the defaul

Sharing Encrypted Tapes – Import/Export OperationsImporting Data Encryption KeysQuantum Encryption Key Manager User’s Guide 537 Possible Step: You may

Sharing Encrypted Tapes – Import/Export OperationsDisplaying the Native Public CertificateQuantum Encryption Key Manager User’s Guide 54Displaying the

Sharing Encrypted Tapes – Import/Export OperationsDisplaying Imported Public CertificatesQuantum Encryption Key Manager User’s Guide 554 Enter your ke

Quantum Encryption Key Manager Service and Installation Manual 56Chapter 77Running ReportsThis chapter details the reports you can run from the Q-EKM

Quantum Encryption Key Manager User’s Guide viiFiguresFigure 1 Q-EKM Components ... 4F

Chapter 7 Running ReportsDrives that Accessed the Q-EKM ServerQuantum Encryption Key Manager Service and Installation Manual 57To generate the tape d

Chapter 7 Running ReportsQ-EKM Server KeysQuantum Encryption Key Manager Service and Installation Manual 58Q-EKM Server KeysThis report provides a li

Chapter 7 Running ReportsEnd User License AgreementQuantum Encryption Key Manager Service and Installation Manual 59End User License Agreement The En

Chapter 7 Running ReportsAvailable WWN Key Ranges for ExportQuantum Encryption Key Manager Service and Installation Manual 602 At the Enter Command p

Quantum Encryption Key Manager User’s Guide 61Chapter 88TroubleshootingThis chapter covers:• Frequently Asked Questions• What to do if Your Q-EKM Serv

TroubleshootingFrequently Asked QuestionsQuantum Encryption Key Manager User’s Guide 62Frequently Asked QuestionsQuestion AnswerHow can I tell if the

TroubleshootingFrequently Asked QuestionsQuantum Encryption Key Manager User’s Guide 63How will I be notified of write/read errors or Q-EKM server pro

TroubleshootingWhat to do if Your Q-EKM Server FailsQuantum Encryption Key Manager User’s Guide 64What to do if Your Q-EKM Server FailsThis section co

TroubleshootingLog FilesQuantum Encryption Key Manager User’s Guide 65Log FilesQ-EKM provides the following log files that can be used for troubleshoo

TroubleshootingLog FilesQuantum Encryption Key Manager User’s Guide 66Debug Log 8The debug log captures a record of everything the Q-EKM server does.

Quantum Encryption Key Manager User’s Guide viiiPrefaceAudienceThis book is intended for storage and security administrators responsible for security

TroubleshootingErrors Reported By Q-EKMQuantum Encryption Key Manager User’s Guide 67When you run the command, Q-EKM creates the following: To capture

TroubleshootingErrors Reported By Q-EKMQuantum Encryption Key Manager User’s Guide 68Error Number Description ActionEE02 Encryption Read Message Failu

TroubleshootingErrors Reported By Q-EKMQuantum Encryption Key Manager User’s Guide 69EE23 Encryption Read Message Failure: Internal error: ”Unexpected

TroubleshootingErrors Reported By Q-EKMQuantum Encryption Key Manager User’s Guide 70EE29 Encryption Read Message Failure: Invalid signatureThe messag

TroubleshootingErrors Reported By Q-EKMQuantum Encryption Key Manager User’s Guide 71EE2C Encryption Read Message Failure: QueryDSKParameterError: “Er

TroubleshootingErrors Reported By Q-EKMQuantum Encryption Key Manager User’s Guide 72EE2E Encryption Read Message Failure: Internal error: Invalid sig

TroubleshootingErrors Reported By Q-EKMQuantum Encryption Key Manager User’s Guide 73EEE1 Encryption logic error: Internal error: “Unexpected error: E

Quantum Encryption Key Manager User’s Guide 74Appendix AASetting the System Path Variable in Windows You may wish to update your system Path environme

Quantum Encryption Key Manager User’s Guide 75GlossaryThis glossary defines the special terms, abbreviations, and acronyms used in this publication an

Quantum Encryption Key Manager User’s Guide 76EEKM Encryption Key Management. A system whereby encryption keys are generated, stored, protected, tra

Quantum Encryption Key Manager User’s Guide ixDocument OrganizationThis document is organized as follows:• Chapter 1, Overview, provides an overview o

Quantum Encryption Key Manager User’s Guide 77SSSL Secure Sockets Layer. A security protocol that works in conjunction with IP to ensure that packet

Quantum Encryption Key Manager User’s Guide 78IndexAaliases 41data encryption key 42public certificate 41asymmetric encryption 7audit log 65Bbacking u

Quantum Encryption Key Manager User’s Guide 79exportingdata encryption keys 47imported keys 49native keys 47public certificate 43Ffailed server 64fail

Quantum Encryption Key Manager User’s Guide 80installing and configuring 24, 56planning 9Q-EKM serverrunning 30status 30stopped 30Quantum Encryption K