Fujitsu ETERNUS LT260 User manual

FUJITSU Storage
ETERNUS LT260 Tape Library
Key Management Function Option
User's Guide
P3AG-1192-02ENZ0

This page is intentionally left blank.

FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
3
Preface
Fujitsu would like to thank you for purchasing our Key Management Function Option for the FUJITSU Storage
ETERNUS LT260 tape library (hereinafter referred to as "LT260").
This manual describes the setup methods and the operation procedures that are required to use the Key
Management Function Option as well as notes and other information.
For information on handling the tape libraries (hereinafter referred to as "tape library", "library", or "device"),
refer to the respective tape library user's guides. For information on console messages and commands of the
backup software used, refer to the manual provided with the backup software.
Second Edition
January 2016
Acknowledgments
•LTO, Linear Tape-Open, and Ultrium are registered trademarks of Hewlett-Packard Development Company,
IBM Corporation and Quantum Corporation.
•Oracle and Java are registered trademarks of Oracle and/or its affiliates.
•Internet Explorer is a trademark or registered trademark of Microsoft Corporation in the United States and
other countries.
•The company names and product names mentioned in this document are registered trademarks or
trademarks of their respective companies.
Microsoft product screen shot(s) reprinted with permission from Microsoft Corporation.

FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
4
About This Manual
Organization
This manual is composed of the following four chapters and an appendix:
●Chapter 1 Overview
This chapter provides a functional overview of the Key Management Function Option.
●Chapter 2 Setup and Operation Procedures
This chapter explains the setup and operation procedures of the key management function.
●Chapter 3 Setup Methods for Different Operations
This chapter explains the setup methods for different operations.
●Chapter 4 Considerations
This chapter provides notes on the Key Management Function Option.
Additional information on "Appendix A Logs Related to the Key Management Function" is provided as an
appendix.

About This Manual
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
5
Warning Notations
Before using the Key Management Function Option, carefully read the contents of this manual to ensure the
safe use of this product. Follow the directions in this manual correctly in order to prevent injury to the user
and/or material damage. After reading, store this manual in a safe place for quick reference.
Warning signs are shown throughout this manual in order to prevent injury to the user and/or material
damage. Carefully check the written descriptions indicated by these signs when reading this manual.
To ensure the safe use of this product, the following symbol (caution symbol) as well as related information is
provided.
Symbols Used in This Manual
•In this manual, a button or menu that is referred to is indicated as, for example, [OK].
•The following marks are used in this manual.
CAUTION
This symbol indicates the possibility of personal injury or material damage when
this product is not used properly.
This marks indicates instructions for general use.
This symbol indicates important points to note when using this product.
This mark indicates additional information regarding things such as convenient
functions and procedures while performing operations and settings with this
product.

FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
6
Table of Contents
Chapter 1 Overview 11
1.1 Overview of the Data Encryption Function of LTO Ultrium Tape Drives .............................. 11
1.2 Features of the Data Encryption Function of LTO Ultrium Tape Drives ............................... 11
1.3 Functional Overview of the Key Management Function Option ......................................... 12
1.4 Features of the Key Management Function Option ........................................................... 13
1.5 Types of Keys .................................................................................................................... 14
1.5.1 Master Key .....................................................................................................................................................14
1.5.2 Encryption Key ............................................................................................................................................... 15
1.5.3 Management of Key Information and Encryption Setting Information ..........................................................16
1.6 Operational Examples ....................................................................................................... 16
1.6.1 Data Sharing between Centers ......................................................................................................................16
1.6.2 Encryption of Data Cartridges Stored at an External Location ........................................................................17
1.6.3 Encryption of Each Logical Library (or Partition) ............................................................................................ 18
1.6.4 Interoperation among LT-series models ........................................................................................................ 19
1.7 Security Functions ............................................................................................................. 20
1.7.1 Security Account ............................................................................................................................................ 20
1.7.2 Network Security ............................................................................................................................................20
1.7.3 Security-Related Logs ....................................................................................................................................20
Chapter 2 Setup and Operation Procedures 21
2.1 Basic Setup ....................................................................................................................... 21
2.1.1 Setting the Key Management Function License .............................................................................................22
2.1.2 Setting the Key Management Function ......................................................................................................... 23
2.1.3 Setting the Master Key ..................................................................................................................................33
2.1.4 Encryption Key Export and Import Functions ................................................................................................. 43
2.2 Backing Up the Setting Information .................................................................................. 56
2.3 Checking the Setting Information ..................................................................................... 57
2.3.1 Setting Information of the Key Management Function .................................................................................. 57
2.3.2 Setting Information of the Key Management Function for the Partition ........................................................ 58
2.3.3 Setting Information of the Key Management Function for the Drive ............................................................. 59
2.3.4 Encryption Setting Information of the Data Cartridge .................................................................................... 60

Table of Contents
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
7
Chapter 3 Setup Methods for Different Operations 64
3.1 Sharing Data among Multiple Tape Libraries .................................................................... 64
3.2 Storing Data Cartridges at External Locations ................................................................... 66
Chapter 4 Considerations 70
4.1 Troubleshooting ................................................................................................................ 70
4.2 Sense Keys Related to the Key Management Function ...................................................... 72
4.3 Reuse of Data Cartridges ................................................................................................... 72
4.4 Connectivity with Backup Software ................................................................................... 73
4.5 Purchasing a License ........................................................................................................73
4.6 Changing the System Firmware ........................................................................................ 73
Appendix A Logs Related to the Key Management Function 74
A.1 How to Download Logs Related to the Key Management Function.................................... 74
A.2 Checking the Contents of the Logs Related to the Key Management Function .................. 74

FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
8
List of Figures
Figure 1.1 How the Key Management Function Option works...................................................................................... 12
Figure 1.2 Automatic generation of encryption keys.................................................................................................... 15
Figure 1.3 Data cartridge sharing using one master key .............................................................................................. 16
Figure 1.4 External storage of data cartridges.............................................................................................................. 17
Figure 1.5 Encryption of each logical library................................................................................................................. 18
Figure 1.6 Interoperation among LT-series models...................................................................................................... 19
Figure 2.1 Basic setup procedure ................................................................................................................................. 21
Figure 2.2 Login screen for the security administrator account .................................................................................... 23
Figure 2.3 Screen for changing the security administrator password ........................................................................... 24
Figure 2.4 Logging in to the remote panel................................................................................................................... 25
Figure 2.5 Initial value of SSL (disabled)...................................................................................................................... 26
Figure 2.6 SSL setting (enabled) .................................................................................................................................. 26
Figure 2.7 Confirming the SSL setting change.............................................................................................................. 27
Figure 2.8 Logging out of the remote panel................................................................................................................. 27
Figure 2.9 Logging in to the security administrator account ........................................................................................ 28
Figure 2.10 Setting the key management function........................................................................................................ 29
Figure 2.11 Setting the key management function (to enable) ..................................................................................... 30
Figure 2.12 Confirming the key management function setting...................................................................................... 30
Figure 2.13 Selecting the key management function..................................................................................................... 31
Figure 2.14 Example of enabling the key management function................................................................................... 32
Figure 2.15 Example of disabling the key management function .................................................................................. 32
Figure 2.16 Setting the master key ................................................................................................................................ 34
Figure 2.17 Confirmation screen for the master key setting........................................................................................... 35
Figure 2.18 Setting a password for the master key......................................................................................................... 36
Figure 2.19 Exporting the master key ............................................................................................................................ 37
Figure 2.20 Saving the master key to export.................................................................................................................. 38
Figure 2.21 Importing the master key............................................................................................................................ 39
Figure 2.22 Confirmation screen for importing the master key ...................................................................................... 40
Figure 2.23 Status of importing the master key ............................................................................................................. 40
Figure 2.24 Deleting the master key .............................................................................................................................. 41
Figure 2.25 Confirmation screen for deleting the master key......................................................................................... 42
Figure 2.26 Encryption key password settings................................................................................................................ 44
Figure 2.27 Selecting the partition to export the target data cartridges ........................................................................ 45
Figure 2.28 Selecting the data cartridges that are to be exported ................................................................................. 46
Figure 2.29 Removing the export target data cartridges................................................................................................ 47
Figure 2.30 Exporting the encryption key ...................................................................................................................... 48
Figure 2.31 Saving the encryption key to export ............................................................................................................ 49
Figure 2.32 Importing the encryption key ...................................................................................................................... 50
Figure 2.33 Confirmation screen for importing the encryption key ................................................................................ 51
Figure 2.34 Progress status screen for importing the encryption key ............................................................................. 51
Figure 2.35 Selecting the partition where the deletion target encryption key exists...................................................... 52
Figure 2.36 Selecting data cartridges with deletion target encryption keys ................................................................... 53
Figure 2.37 Excluding data cartridges with deletion target encryption keys .................................................................. 54
Figure 2.38 Selecting imported encryption keys that are to be deleted ......................................................................... 54
Figure 2.39 Deleting the imported encryption keys ....................................................................................................... 55
Figure 2.40 Deletion confirmation of the imported encryption key................................................................................ 55
Figure 2.41 Confirmation screen if an attempt at restoring the settings file for the library configuration is
performed ................................................................................................................................................... 56

List of Figures
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
9
Figure 2.42 [Status > Security > Security Encryption Status] screen................................................................................ 57
Figure 2.43 [Status > Security > Partition Encryption Status] screen .............................................................................. 58
Figure 2.44 [Status > Security > Drive Encryption Status] screen.................................................................................... 59
Figure 2.45 [Status > Cartridge Inventory > List View] screen......................................................................................... 60
Figure 2.46 [Status > Cartridge Inventory > List View (detailed)] screen........................................................................ 61
Figure 2.47 [Status > Cartridge Inventory > Graphical View] screen ............................................................................... 63

FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
10
List of Tables
Table 4.1 Troubleshooting .......................................................................................................................................... 70
Table 4.2 Sense keys................................................................................................................................................... 72
Table A.1 Events related to the key management function......................................................................................... 77

FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
11
Chapter 1
Overview
1.1 Overview of the Data Encryption Function of LTO Ultrium
Tape Drives
LTO Ultrium tape drives that are installed in the LT260 tape library have the function to write data to data
cartridges (*2) with AES (*1) (256 bit) .
With this function, data is assigned an arbitrary key when written to a data cartridge (*2), and the data can
be read only if the same key is assigned again at the data read time.
The function can thus prevent leakage of information on the tape cartridge, even if the tape cartridge is left
unattended when taken out or is missing, because its data cannot be read without the key.
Also, the tape cartridge can be disposed of without deleting the data.
*1: Advanced Encryption Standard (AES): Encryption system authorized by the National Institute of Standards and
Technology (NIST)
*2: The data encryption function is incompatible with Ultrium3 or earlier generation data cartridges.
1.2 Features of the Data Encryption Function of LTO Ultrium Tape
Drives
The data encryption function of LTO Ultrium tape drives has the following features:
•The function conforms to the high security requirements specified in FIPS 140-2 (*1).
•A key can be delivered through the host interface and the interface between a library and tape drive.
•The encryption logic is implemented by hardware, which means that encryption has less effect on read-
write performance.
*1: FIPS 140-2 defines the U.S. government's security requirements for cryptographic modules used for data.

Chapter 1 Overview
1.3 Functional Overview of the Key Management Function Option
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
12
1.3 Functional Overview of the Key Management Function
Option
The Key Management Function Option allows the use of the encryption function provided by Ultrium tape
drives to manage encryption keys on the tape library.
Figure 1.1 shows how the Key Management Function Option works.
Figure 1.1 How the Key Management Function Option works
The Key Management Function Option applies the encryption settings from the remote panel to the tape
library and assigns one key called the master key. The encryption key that is automatically generated for each
data cartridge by the tape library is based on the master key, and this information is stored in a database in
the tape library.
During a data backup from a backup server, the tape library automatically assigns an encryption key to the
specified data cartridge, encrypts the data (plaintext), and saves the data. The encryption process is
performed transparently during this time.
Key Management Function Option
Encryption setting
(When the encryption
settings are applied)
Tape library
Key management
database
Backup server
Plain text
Encrypted data
LTO Ultrium
tape drive
Encryption key
Master key
Remote panel

Chapter 1 Overview
1.4 Features of the Key Management Function Option
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
13
1.4 Features of the Key Management Function Option
The Key Management Function Option has the following features:
•It enables easy construction of a secure backup system that is independent of the OS and backup software,
since the tape library will automatically handle encryption. (*1)
•Because encryption keys are set for the tape library from a Web browser terminal, the library manager
alone can ensure the security of the library, with no need for a backup operator to intervene.
•One master key is set for each tape library, and encryption keys based on the master key are automatically
assigned to all data cartridges in the tape library. Thus, the library manager need not manage any of the
encryption keys of the data cartridges. (*2)
•Setting the same master key as the common master key for the ETERNUS LT220, LT230, LT250, LT260,
LT270, and LT270 S2 (*3) will facilitate the use of encrypted tape cartridge data among all these tape
libraries.
•To share data among multiple tape libraries, Fujitsu recommends operation with a common master key. In
the event of a disaster, a data cartridge stored at an external location may need to be read with a tape
library having a different master key. This different tape library can read the data on the data cartridge
only if the encryption key had been exported in advance using the encryption key export or import
function (*4).
*1: The Key Management Function Option cannot be used together with the encryption function of backup software.
*2: For information on master keys, refer to "1.5.1 Master Key" (page 14). For information on encryption keys, refer to
"1.5.2 Encryption Key" (page 15).
*3: The ETERNUS LT20, LT20 S2, LT40, LT40 S2, LT60, LT60 S2, LT200, and LT210 do not support the key management
function. The ETERNUS LT220, LT230, LT250, and LT270 have been discontinued.
*4: For information on the encryption key export or import function, refer to "2.1.4 Encryption Key Export and Import
Functions" (page 43).
The following tape drives and tape cartridges are required to use the Key Management Function Option:
•LTO Ultrium5 (G5) or later tape drives
•LTO Ultrium4 (G4) or later tape cartridges
For other required optional products, refer to "FUJITSU Storage ETERNUS LT260 Tape Library Product List". For
more details about tape cartridges, refer to "A.1 Ultrium Tape Cartridge" in "FUJITSU Storage ETERNUS LT260
Tape Library User’s Guide -Installation & Operation-".
To use the key management function, purchasing the Key Management Function Option is required.

Chapter 1 Overview
1.5 Types of Keys
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
14
1.5 Types of Keys
The Key Management Function Option uses two types of keys for encryption: the master key that must have
been set for each LT260 tape library, and the encryption key assigned to each tape cartridge in the tape
library.
This section describes these keys.
1.5.1 Master Key
A master key is set for each tape library.
The tape library must have a master key set in order for the Key Management Function Option to work.
The functions of a master key are listed below.
•The encryption key for a data cartridge is automatically generated from a master key. (*1)
•The same master key can be set for multiple tape libraries. This function enables these multiple tape
libraries to share data cartridges containing encrypted data.
•The tape library manager can make the settings to set a master key.
•In a logical library (or partition) configuration, a master key can also be assigned for reach logical library
(or partition).
*1: Since automatically generated master keys are managed only by the tape library, their values are invisible to users.
The two methods of creating a master key are as follows: automatic generation using the tape library and
manual creation using arbitrary characters.
For automatic generation with a tape library, each tape library automatically generates a master key based
on data unique to the tape library. For this reason, other tape libraries cannot generate the same master key.
Once a master key is created, the master key can no longer be decrypted even by a maintenance engineer.
Although the master key is stored redundantly in the database of the tape library, it may be lost in the rare
event that the tape library fails. The encrypted data can no longer be read in such a case. Therefore, after
setting the master key, be sure to export it (to a binary file) and keep it in a safe place.
For information on setting a master key, refer to "2.1.3 Setting the Master Key" (page 33).
For information on exporting the master key, refer to "2.1.3.2 Exporting the Master Key" (page 35).

Chapter 1 Overview
1.5 Types of Keys
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
15
1.5.2 Encryption Key
An encryption key is assigned to each data cartridge.
Different data cartridges never have the same encryption key because the tape library automatically
generates an encryption key based on the master key and data unique to each data cartridge.
If different tape libraries have the same master key and same data unique to the data cartridge, the libraries
will generate the same encryption key for the cartridge.
Only one encryption key is assigned to each data cartridge.
During normal operations, because the tape library performs the encryption key operations, the user is not
involved.
Figure 1.2 Automatic generation of encryption keys
The encryption key export or import function can be used to export or import only an encryption key (a
password and encrypted binary file) for data sharing between tape libraries with different master keys.
However, note that if the encryption key is lost, the data can no longer be restored.
To share data among tape libraries, Fujitsu recommends operation with a common master key.
•An encryption key is generated and assigned when a data write process is performed to the data
cartridge.
•For information on the encryption key export or import function, refer to "2.1.4 Encryption Key Export and
Import Functions" (page 43).
Tape cartridge
Operator
Setting
Non-
encryption
Database for key management
Encryption
key 0 Encryption 0
Encryption 1
Encryption 2
Specific information of
the tape cartridge
Encryption
key 1
Encryption
key 2
Automatic generation
Master key

Chapter 1 Overview
1.6 Operational Examples
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
16
1.5.3 Management of Key Information and Encryption Setting Information
Although key information and encryption setting information are stored in a redundant manner in the tape
library, encryption keys may be lost in the rare event that the tape library fails. The encrypted data saved on
data cartridges can no longer be decrypted in such a case. Therefore, after registering a master key or setting
an encryption key for a data cartridge, be sure to export the encryption key and keep it in a safe place.
For information on exporting a master key, refer to "2.1.3.2 Exporting the Master Key" (page 35). For
information on backing up encryption setting information, refer to "2.2 Backing Up the Setting Information"
(page 56).
1.6 Operational Examples
It is not necessary to make any change to existing operations in order to use data encryption using the Key
Management Function Option.
This section describes operational examples of sharing data on encrypted data cartridges among multiple
tape libraries and external storage of encrypted data cartridges.
1.6.1 Data Sharing between Centers
Setting the same master key for multiple tape libraries installed in the same center or separate centers
enables these libraries to share data cartridges with encryption keys hidden from view.
Figure 1.3 Data cartridge sharing using one master key
Primary-site
Master key A
Backup-center
Transported only the cartridges
Master key A

Chapter 1 Overview
1.6 Operational Examples
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
17
1.6.2 Encryption of Data Cartridges Stored at an External Location
For disaster recovery, encrypted data cartridges can be stored at an external location and, when needed,
brought back to read the data on them. Even if a data cartridge in storage is lost or stolen, the encryption can
prevent data leakage.
Once a data cartridge in storage is inserted into its original tape library or one with the same master key, the
data can be read from the library without setting the key again.
Figure 1.4 External storage of data cartridges
Once encryption keys are exported, even if the tape library becomes unavailable such as in the event of a
disaster, data on the data cartridge can be read by importing the encryption key to a tape library with a dif-
ferent master key.
Secondary-site
Master key A
Encryption key
Primary-site
Encryption key
Master key A

Chapter 1 Overview
1.6 Operational Examples
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
18
1.6.3 Encryption of Each Logical Library (or Partition)
In a logical library (or partition) configuration, the master key can be assigned individually to each logical
library (or partition).
Figure 1.5 Encryption of each logical library
Master key
: Encryption
: Non-Encryption
Lib #3
Lib #2
Lib #1
Master key

Chapter 1 Overview
1.6 Operational Examples
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
19
1.6.4 Interoperation among LT-series models
The ETERNUS LT220, LT230, LT250, LT260, LT270, and LT270 S2 tape libraries (hereinafter referred to as "LT-
series") share compatible master keys and encryption keys, so keys and encrypted data cartridges can be
shared among these LT series.
Setting a common master key for these tape libraries facilitates data sharing and data migration between the
tape libraries.
Figure 1.6 Interoperation among LT-series models
*1: Sales of the ETERNUS LT220, LT230, LT250, and LT270 tape libraries have been discontinued.
The Key Management Function Option does not support interoperability with the tape libraries, encryption
devices, software encryption functions, and other related hardware or software manufactured by other
companies.
LT270 S2
LT220 (*1)
LT230 (*1)
LT250 (*1)
LT270 (*1)
LT260

Chapter 1 Overview
1.7 Security Functions
FUJITSU Storage ETERNUS LT260 Tape Library Key Management Function Option User’s Guide
Copyright 2016 FUJITSU LIMITED P3AG-1192-02ENZ0
20
1.7 Security Functions
This section describes the security functions that are used for the Key Management Function Option.
1.7.1 Security Account
The security account is used from the remote panel for operations and settings related to the key
management function.
To log in to the remote panel, the security administrator account, "security", is used for operations and
settings of the key management function.
The security administrator logs in with this dedicated account to make all the relevant settings. Anyone who
logs in with another account cannot modify the settings of the key management function.
For information on how to log in with the security account, refer to "2.1.2.2 Logging in to the Remote Panel"
(page 25).
1.7.2 Network Security
The protocol for the connection to the remote panel via a LAN can be set to "https," which encrypts the data
that is the transmitted information.
For information on the https setting, refer to "2.1.2.3 Enabling SSL" (page 26).
1.7.3 Security-Related Logs
A history of key management function operations or settings is automatically recorded in a log. This enables
the tracking of unauthorized access and operations.
For information on the storage and contents of the security-related logs, refer to "Appendix A Logs Related to
the Key Management Function" (page 74).