RE: LTO4 Encryption

["Ingvaldson, Scott" <scott.ingvaldson@xxxxxxxxxx>]

Ken and Justin -

Thanks for the info.

Regards,

Scott Ingvaldson
Senior IBM Support Specialist
Midwest Region Data Center
Fiserv.
 

-----Original Message-----
From: Justin C. Haase [mailto:jchaase@xxxxxxxxx] 
Sent: Tuesday, September 15, 2009 11:52 AM
To: Midrange Systems Technical Discussion
Subject: Re: LTO4 Encryption

Using HW-based encryption on many customer systems - it's great.  Adds maybe 5 seconds to the start of each operation on individual volumes as the library goes out and requests crypto information.  Only problems I've encountered have been firmware or network related.
Ensure you're at latest FW on the tape library and all tape drives inside.

It's a bonus to have one of the key managers on a VM or a laptop so in the event of a disaster, your keystore is mobile.  Not required, but can make things easier.

The encryption path verification tool on the web interface of the tape library is very helpful.

-jch

On Tue, Sep 15, 2009 at 11:01 AM, Graap, Kenneth <Kenneth.Graap@xxxxxxxxxxxxx> wrote:
> I recently was doing some research on this topic and this is some 
> information I got from an IBM rep ....
>
> Quote:
>
> Our encryption solution is outstanding ... you need to pick a library 
> vs a standalone drive and you need to attach via fibre or SAS.  You 
> then load up at least 2 Windows boxes with the key manager, called 
> TKLM, and you're off to the races.  We can run an encrypted backup at 
> the same speed as a non-encrypted backup which sets us apart from all 
> the SW-based and appliance-based encryption solutions.  If you're 
> going to do encryption, we'd encourage you to get our Lab Services guy 
> to come onsite to help you set it up to make sure you have all the 
> proper stuff set up to protect your keys, since without them, you're 
> toast.  For example ... you need to make sure you have encryption 
> capable gear and a key manager at your DR site too, plus backup copies 
> of your key manager each time you change your keys.
>
> Additional information ....
>
> TS2900 - single half high (HH) LTO4 SAS drive with 9 library slots (1 
> of them is a convenience io) TS3100 - single full high (FH) LTO4 SAS 
> or fibre drive, or dual HH LTO4 SAS drives with 24 library slots (1 of 
> them is a convenience io) TS3200 - dual full high (FH) LTO4 SAS or 
> fibre drives, or up to 4 HH
> LTO4 SAS drives with 24 library slots  (3 of them are a convenience 
> io) TS3310 - modular library running from 1 chassis with 1-2 FH LTO4 
> SAS or fibre drives with up to 4 expansion chassis with up to 4 drives 
> in each for a total of 18 drives TS3500 - our big enterprise library 
> with up to 192 FH fibre LTO4 drives.
> It can also hold TS1120/TS130 enterprise drives if you prefer.  The 
> first frame holds up to 12 drives
>
> Fibre drives give you better sharing across LPARs via a switch, but 
> SAS drives and adapters are cheaper.  SAS needs V6R1 and POWER6.  If 
> you go with fibre, you can get the new IOPless fibre cards if you're 
> on POWER6 and V6R1 (they take 1 slot vs 2,and have 2 ports with 64 
> addresses each, compared with 1 port with 16 addresses on the IOP'd 
> cards), otherwise you can just use the older IOP'd cards.
>
> Here are some #'s so you can see the dazzling performance of the LTO4 
> drives ..
>
>                                        usermix                large 
> file
>                                        ---------------
> -------------------
>        3590-E on fibre on 5xx CPU's        95 GB/hr        140 GB/hr
>        HH LTO4 on fibre on 5xx CPU's        220 GB/hr        700 GB/hr 
> <<< see note
>        FH LTO4 on fibre on 5xx CPU's        220 GB/hr        890 GB/hr
>
> Note: HH LTO4 drives have the same burst rate as FH drives, but they 
> can't sustain it.  However, not many folks have big enough files to 
> hit those speeds anyway
>
> End Quote:
>
> I hope this information was useful ....
>
>
> Kenneth
> Kenneth E. Graap
> http://www.linkedin.com/in/kennethgraap
>
>
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx
> [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Ingvaldson, 
> Scott
> Sent: Tuesday, September 15, 2009 7:42 AM
> To: midrange-l@xxxxxxxxxxxx
> Subject: LTO4 Encryption
>
> Is anyone doing LTO4 hardware encryption?  We will soon be upgrading 
> to
> LTO4 drives in our TS3100 libraries and would like to know what we 
> need to do to implement hardware encryption.  We're at V6R1 with BRMS.
>
> Regards,
>
> Scott Ingvaldson
> Senior IBM Support Specialist
> Midwest Region Data Center
> Fiserv.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, 
> unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take 
> a moment to review the archives at http://archive.midrange.com/midrange-l.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, 
> unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take 
> a moment to review the archives at 
> http://archive.midrange.com/midrange-l.