User manual HP STORAGEWORKS MSL4048 TAPE LIBRARY

[. . . ] HP StorageWorks 1/8 G2 and MSL Encryption Kit User guide Part number: AM495-96001 First edition: June 2008 Legal and notice information © Copyright 2008 Hewlett-Packard Development Company, L. P. Valid license from HP required for possession, use or copying. Consistent with FAR 12. 211 and 12. 212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U. S. Government under vendor's standard commercial license. [. . . ] See the Getting started guide that came with the Autoloader or Library, or the User and service guide on the documentation CD for instructions on configuring the network and using the RMI. You can also find these documents on the HP website at http://www. hp. com/support/manuals. Verify your Autoloader or Library firmware version Verify that your Autoloader or Library has current firmware. If you see the Status: Security tab in the RMI, the firmware supports the Encryption Kit. If this tab is missing, update the Autoloader or Library firmware to the current version. Neither the administrator password nor token PIN are required to see the Status: Security tab. User guide 23 Figure 6 RMI Configuration: Security tab You can download Autoloader or Library firmware files from the HP Support website at http://www. hp. com/support. Locate the USB port Locate the USB port on the back panel of the Autoloader or Library. 11868 Figure 7 USB port location If the USB port is covered with silver tape, remove the tape. Preparing the key server tokens As part of your security process, you will need to track each key server token, along with information associated with the token. If you do not have a security policy that specifies this information see Chapter 2 on page 19 for information about creating your encryption key management processes. The Encryption Kit includes two methods of tracking the tokens. Choose the approach that works best for your security policy and organization. HP recommends that you use both approaches. · Attached tag -- The Encryption Kit includes a card and holder, which can be used to attach information to the token. · Serial number -- Each key server token has a unique serial number. You can use the serial number to identify the key server token and correlate the tape cartridges written with keys on the token. TIP: The serial number is on the bottom of the token when the token is in the Autoloader or Library, making it difficult to see. You can also find the token serial number on the RMI Status: Security page. You do not need the administrator password to see the Status: Security page. 24 Installing and configuring the Encryption Kit IMPORTANT: HP recommends that you maintain a record of the tape cartridges that are written with encryption keys on the key server token. When restoring the data from an encrypted tape, you will need to use a key server token containing the encryption key for that tape. The name of the key server token is not stored on the tape and the name of the tape is not stored on the key server token. If you do not know which token contains the key for a tape, you may need to try all of your key server tokens when restoring data from an encrypted tape. NOTE: If you are using Encryption Kits with multiple Autoloaders or Libraries, you will need to track the Autoloader or Library used with each token as this information is not recorded on the token. To use the attached tags to identify the tokens: 1. Write the token identification information on the paper cards. Track the tape cartridges that are written with keys stored on the token and keep a copy of this record in a secure location. To use the serial numbers to identify the tokens: · Record the token identification information and tape cartridges that are written with keys stored on the token, and keep a copy of the record in a secure location. Configuring encryption In this section, you will configure the name and PIN for the key server token, and configure encryption on the Autoloader or Library. Insert the key server token Insert the key server token in the USB port on the back panel of the Autoloader or Library. 11869 Figure 8 Inserting the key server token Enter the PIN When a key server token is inserted for the first time in any Autoloader or Library, the Autoloader or Library will recognize it as a new token and display a dialog on the RMI requesting that you enter a PIN. User guide 25 The new PIN must be at least eight characters long and contain at least one capitol letter, at least one lower case letter, and at least two numbers. [. . . ] Back up the token to a different file or restore the keys from a different recent backup file with a known password. Check the RMI Status: Security page to verify that the correct token is installed in the Autoloader or Library. Either replace the token with the correct token or restore the token backup file to a new token. Restore the latest token backup file to a new token and be sure not to lose the PIN for the new token. [. . . ]