User manual HP DATA PROTECTOR V6.0 SOFTWARE

[. . . ] user manual AES Encryption for HP Data Protector 6. 0 December 2006 Legal and notice information © Copyright 2006 Hewlett-Packard Development Company, L. P. Hewlett-Packard Company makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. [. . . ] Figure 5 shows a backup with XOR encryption. 22 Additional Backup and Restore Scenarios Figure 5 Backup with XOR encryption Restoring data that is already backed up using XOR encoding or custom built encryption To restore backed up data using XOR encoding or custom built encryption, you need not modify the keys in the omnikeystore file. HP Data Protector automatically determines the XOR or custom library used for encryption, and the same library is used for decryption. Figure 6 shows the restore operation with XOR encryption. AES Encryption for HP Data Protector 6. 0 23 Figure 6 Restoring with XOR encryption or a custom built encryption NOTE: The libde library used for encryption during backup must not be replaced, because the same file is used for decryption during restore. 24 Additional Backup and Restore Scenarios Restoring encrypted backups performed on host A to another host B To restore any encrypted backups performed on host A to another host B, complete the following steps: 1. On host A, check the key number (KEY NO) of the key to be imported by entering the omnikeytool -print command. Note the key number given in the KEY NO field that is used for backup. Example: On host A, enter the following command: #omnikeytool -print *********************************OMNIKEYSTORE********************************* -----------------------------------------------------------------------------|KEY NO| |TYPE| |STATUS| |KEY ID| |START TIME| -----------------------------------------------------------------------------1 1 INACTIVE -------------------------------- 10:32 27-Oct-2006 2 3 INACTIVE d08840ac28b361f02b3530514b505cc2 10:34 27-Oct-2006 3 1 INACTIVE -------------------------------- 10:35 27-Oct-2006 4 3 INACTIVE dc7d01a744e8c89433f93b4d235f6c68 10:35 27-Oct-2006 5 1 INACTIVE -------------------------------- 10:41 27-Oct-2006 6 3 ACTIVE 7ba3b522ba3c66ad73e8b411d6f5a997 10:42 27-Oct-2006 In this output, if the key with the key number (KEY NO) 2 is used to take a backup of the file on host A, then import key 2 after performing step 2. Copy the omnikeystore file from host A to host B on any location other than /opt/omni. Example: You can copy the file to the /tmp directory using ftp or rcp. Import the key with the key number (KEY NO) to the host B's omnikeystore file by entering the following command: #omnikeytool -import -keyno <KEY_NO> -file <SOURCE_KEYSTORE> Example: Import the key with the key number (KEY NO) 2 into host B's omnikeystore file by using the following command: #omnikeytool -import -keyno 2 -file /tmp/omnikeystore A Successfully imported the record message is displayed. NOTE: Imported keys are used only for restore. For information on managing keys, see Managing keys in the omnikeystore file. You can now restore data on host B for the encrypted file backed up on host A. AES Encryption for HP Data Protector 6. 0 25 Using the custom built encryption or XOR encoding instead of AES encryption Table 7 lists the use of custom built encryption or XOR encoding, instead of AES encryption for backups and restore. Table 7 Recommended steps for using XOR encoding or custom built encryption Condition If the omnikeytool command is not used to create the omnikeystore file. Steps to be performed Set the encode option in the HP Data Protector GUI or set the omnirc variable OB2ENCODE set to 1, so that backups are encoded using XOR/custom library for encoding. For information on enabling encryption, see Enabling encryption for a backup specification. For information on using the omnirc variables, see HP Data Protector Help. · Use the omnikeytool ­create ­type ­1 command in the HP Data Protector Command-Line Interface (CLI) to indicate that you want to use XOR encoding. · To select the custom built encryption, use the command omnikeytool ­create ­type ­<type no>, where:­<type no> is the number used for the custom built encryption. If the omnikeytool command is already used to create the omnikeystore file. NOTE: Here, the ­<type no> is greater than or equal to 50, and depends on the custom built encryption being used. · To deactivate AES encryption, use the command omnikeytool -deactivate -keyno <KEY_NO>. For more information, see Deactivating the backup key to a key with a serial number. To reactivate AES encryption, use the command omnikeytool -activate -keyno <KEY_NO>. For more information, see Setting the backup key to a key matching a key number. Using a new key for all backups from a given host Enter the omnikeytool ­create command to create a new key for all backups from a given host. The newly generated key is automatically used as the backup key. All disk agents (even from existing sessions) that start after the new key creation use the new key for backups. 26 Additional Backup and Restore Scenarios Using a common omnikeystore file across hosts A and B To use a common omnikeystore file across hosts A and B, complete the following steps: Use the omnirc variable OB2ENCODE_KEYSTORE to specify the location of the shared omnikeystore file on host A and B. [. . . ] Can I specify within a backup specification two different objects with different encryption methods?Yes, if you are using different omnirc files (on different clients). Is media copy possible from a tape with unencrypted content?Media copy uses MA only, therefore no DA-encryption is possible from a tape. [. . . ]