Dell PowerVault ML6000 User Manual

<keyAlias1>cert1</keyAlias1> - keyAlias2
<dateTime>Tue Feb 20 09:18:07 CST 2007</dateTime> - creation date
</KeyUsageEvent>
Note: For LTO 4 and LTO 5 drives there will only be <keyAlias1></keyAlias1>
record and DKi will be recorded.
Querying the Metadata XML File
Use the EKMDataParser tool to query the metadata file. This tool parses the XML
file using Document Object Model (DOM) techniques and cannot be run from the
Encryption Key Manager command line interface. It is invoked as follows:
java com.ibm.keymanager.tools.EKMDataParser -filename
full_path_to_metadata_file {-volser volser | -keyalias alias}
metadata_path
This is the same directory path specified for the metadata file in
Audit.metadata.file.name in the KeyManagerConfig.properties file.
-filename
filename is required and must be the name of the XML metadata file. This will
usually match the name specified in the Audit.metadata.file.name property in
the KeyManagerConfig.properties file.
-volser
The volume serial number of the tape cartridge you are searching for in the
XML file. Either -volser or -keyalias must be specified.
-keyalias
The key label or alias you are searching for in the XML file. Either -volser or
-keyalias must be specified.
Example
Assuming that the metadata filename property (Audit.metadata.file.name) in
KeyManagerConfig.properties is set to a value of metadata and the file is located
in your local directory where the Encryption Key Manager runs, the following
command would filter (display) only the XML records related to volser 72448:
<jvm_path>/bin/java com.ibm.keymanager.tools.EKMDataParser -filename metadata -volser 72448
The output would be formatted as follows:
Table 8-1. Metadata Query Output Format
keyalias1 keyalias2 volSer dateTime driveSSN dki
cert1 cert2 72448 Wed Mar 14 10:31:32 CDT 2007 FVTDRIVE0004
Recovering from a Corrupted Metadata File
The Encryption Key Manager metadata file can become corrupted if the Encryption
Key Manager is improperly shutdown or the system where the Encryption Key
Manager is running crashes. Improper editing or modification of the metadata file
can also corrupt it. The corruption will go unnoticed until the EKMDataParser
parses the metadata file. The EKMDataParser may fail with an error similar to the
following:
8-2 Dell Encryption Key Mgr User's Guide
|

Dell PowerVault ML6000 Specifications

General

Type	Tape Library
Drive Types	LTO-4, LTO-5, LTO-6
Connectivity	SAS
Interface	SAS
Management Interface	Web-based
Tape Technology	LTO
Scalability	Scalable to multiple libraries

Summary

Preface

About this Book

Provides an overview of the manual's content and scope.

Who Should Read this Book

Identifies the target audience for the user's guide.

Conventions and Terminology Used in this Book

Explains typographic conventions and terminology used throughout the document.

Attention Notice

Highlights potential damage to programs, devices, systems, or data.

Related Publications

Lists other Dell publications for more information.

Online Support

Directs users to Dell's online support resources.

Chapter 1. Tape Encryption Overview

Components

Details the main components of the Encryption Key Manager.

Managing Encryption

Explains the process and methods of managing tape encryption.

Application-Managed Tape Encryption

Describes encryption managed by backup applications.

Library-Managed Tape Encryption

Describes encryption managed by the Encryption Key Manager via the library.

About Encryption Keys

Explains encryption key types, generation, and usage.

Chapter 2. Planning Your Encryption Key Manager Environment

Encryption Setup Tasks at a Glance

Provides a checklist of tasks for setting up encryption.

Encryption Key Manager Setup Tasks

Outlines essential tasks for configuring the Encryption Key Manager.

Planning for Library-Managed Tape Encryption

Details requirements for library-managed tape encryption.

Hardware and Software Requirements

Lists the necessary hardware and software for the system.

Keystore Considerations

Highlights the importance of preserving keystore data.

Backing up Keystore Data

Provides critical instructions for backing up keystore data for recovery.

Encryption Key Manager Server Configurations

Describes single-server and two-server configurations for the key manager.

Federal Information Processing Standard 140-2 Considerations

Addresses FIPS 140-2 certification requirements for cryptographic providers.

Chapter 3. Installing the Encryption Key Manager and Keystores

Installing the Encryption Key Manager on Linux

Provides step-by-step instructions for installing EKM on Linux.

Installing the Encryption Key Manager on Windows

Provides step-by-step instructions for installing EKM on Windows.

Using the GUI to Create a Configuration File, Keystore, and Certificates

Details using the GUI to create configuration files, keystores, and certificates.

Generating Keys and Aliases for Encryption on LTO 4 and LTO 5

Explains how to generate encryption keys and aliases for LTO drives.

Creating and Managing Key Groups

Covers organizing symmetric keys into key groups.

Chapter 4. Configuring the Encryption Key Manager

Automatically Update Tape Drive Table

Explains automatic addition of new drives to the drive table.

Synchronizing Data Between Two Key Manager Servers

Details methods for synchronizing data between key manager servers.

Chapter 5. Administering the Encryption Key Manager

Starting, Refreshing, and Stopping the Key Manager Server

Guides on managing the lifecycle of the key manager server.

The Command Line Interface Client

Explains how to use the CLI client for managing EKM.

CLI Commands

Lists and describes available commands for the CLI client.

Chapter 6. Problem Determination

Check These Important Files for Encryption Key Manager Server Problems

Identifies key files for troubleshooting server startup issues.

Debugging Communication Problems Between the CLI Client and the EKM Server

Provides steps to diagnose and resolve communication issues between client and server.

Encryption Key Manager-Reported Errors

Lists common errors reported by EKM and their solutions.

Chapter 7. Audit Records

Audit Overview

Describes the audit subsystem and its record generation.

Audit Configuration Parameters

Details parameters for configuring audit log behavior.

Audit Record Format

Explains the structure and format of audit records.

Chapter 8. Using Metadata

Querying the Metadata XML File

Explains how to query the metadata XML file using EKMDataParser.

Recovering from a Corrupted Metadata File

Provides steps to recover corrupted metadata files.

Appendix A. Sample Files

Sample Configuration Files

Offers example EKM properties files for configuration.

Appendix B. Encryption Key Manager Configuration Properties Files

Encryption Key Manager Server Configuration Properties File

Details properties for the EKM server configuration file.

CLI Client Configuration Properties File

Details properties for the EKM CLI client configuration file.

Appendix C. Frequently Asked Questions

What happens when the certificate being used to encrypt the tapes expires? Will the Encryption Key Manager read previously encrypted tapes?

Explains how expired certificates affect reading encrypted tapes.

Will the Encryption Key Manager require that a certificate be renamed on renewal?

Discusses certificate renewal and its impact on the Encryption Key Manager.

Notices

Trademarks

Lists trademarks used in the document.

Glossary