HP P9000 User manual

HP StorageWorks
P9000 DKA Encryption User Guide
Abstract
This guide describes and provides instructions for using the HP StorageWorks P9000 DKA Encryption License Key software to
configure and perform HP DKA Encryption License Key operations. The intended audience is a storage system administrator
or authorized service provider with independent knowledge of HP StorageWorks P9000 disk arrays and the HP StorageWorks
Remote Web Console.
HP Part Number: AV400-96364
Published: May 2011
Edition: Fourth

© Copyright 2010, 2011 Hewlett-Packard Development Company, L.P.
Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial
Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under
vendor's standard commercial license.
The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express
warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall
not be liable for technical or editorial errors or omissions contained herein.
Export Requirements
You may not export or re-export this document or any copy or adaptation in violation of export laws or regulations.
Without limiting the foregoing, this document may not be exported, re-exported, transferred or downloaded to or within (or to a national resident
of) countries under U.S. economic embargo, including Cuba, Iran, North Korea, Sudan, and Syria. This list is subject to change.
This document may not be exported, re-exported, transferred, or downloaded to persons or entities listed on the U.S. Department of Commerce
Denied Persons List, Entity List of proliferation concern or on any U.S. Treasury Department Designated Nationals exclusion list, or to parties directly
or indirectly involved in the development or production of nuclear, chemical, biological weapons, or in missile technology programs as specified
in the U.S. Export Administration Regulations (15 CFR 744).
Revision History
DescriptionDateEdition
Applies to microcode version 70-01-01-00/00 or later.October 2010First
Applies to microcode version 70-01-24-00/00 or later.November 2010Second
Applies to microcode version 70-01-62-00/00 or later.January 2011Third
Applies to microcode version 70-02-01-00/00 or later.May 2011Fourth

Contents
1 About DKA Encryption................................................................................5
Resources that can be executed for each function..........................................................................5
DKA Encryption........................................................................................................................5
Encryption specifications............................................................................................................5
Encryption key operations..........................................................................................................6
Data encryption operations........................................................................................................7
Data encryption...................................................................................................................7
Disabling encryption............................................................................................................7
Changing the encryption key.................................................................................................7
Audit logging of encryption events..............................................................................................7
2 Preparing for DKA Encryption operations.......................................................8
System requirements .................................................................................................................8
Interoperability considerations ...................................................................................................8
Configuring Remote Web Console..............................................................................................9
3 Performing DKA Encryption operations........................................................10
Creating the encryption key.....................................................................................................10
Backing up the encryption key..................................................................................................10
Enabling data encryption........................................................................................................11
Disabling data encryption........................................................................................................12
Restoring the encryption key.....................................................................................................12
Deleting the encryption key......................................................................................................13
4 Troubleshooting........................................................................................14
Troubleshooting......................................................................................................................14
5 Support and other resources......................................................................15
Contacting HP........................................................................................................................15
Subscription service............................................................................................................15
Documentation feedback....................................................................................................15
Related information.................................................................................................................15
HP websites......................................................................................................................15
Conventions for storage capacity values....................................................................................16
Typographic conventions.........................................................................................................16
A DKA Encryption GUI reference...................................................................18
Top window when selecting encryption keys...............................................................................18
Create Keys window...............................................................................................................19
Backup Keys wizard................................................................................................................20
Backup Keys window..........................................................................................................20
Confirm window................................................................................................................20
Restore Keys wizard................................................................................................................21
Restore Keys window..........................................................................................................21
Confirm window................................................................................................................21
Delete Keys window................................................................................................................22
Edit Encryption wizard.............................................................................................................22
Contents 3

Edit Encryption window......................................................................................................22
Confirm window................................................................................................................25
Glossary....................................................................................................26
Index.........................................................................................................27
4 Contents

1 About DKA Encryption
Unless otherwise specified, the term P9000 in this guide refers to the following disk array:
•P9500 Disk Array
The GUI illustrations in this guide were created using a Windows computer with the Internet Explorer
browser. Actual windows may differ depending on the operating system and browser used. GUI
contents also vary with licensed program products, storage system models, and firmware versions.
This chapter describes the DKA Encryption feature.
Resources that can be executed for each function
Remote Web Console main window shows only the resources that are assigned to a user who logs
into the Remote Web Console. The window may also show the related resources that are required
to manage the assigned resources.
When you use the functions described in this manual, the resources for each operation must satisfy
the specific conditions. For details on user accounts, see HP StorageWorks P9000 Remote Web
Console User Guide. For details on the conditions of the resources, see HP StorageWorks P9000
Provisioning for Open Systems User Guide or HP StorageWorks P9000 Provisioning for Mainframe
Systems User Guide.
DKA Encryption
The DKA Encryption feature of the P9500 storage system enables users to implement and manage
data encryption on the storage system. Data encryption prevents "leakage" of information from
the storage system, for example, during disk drive replacement or in the case of theft.
Encryption provides hardware-based strong encryption (AES 256) that is compatible with both
open and mainframe systems. Encryption can be applied to some or all of the internal drives with
no throughput or latency impacts for data I/O and little or no disruption to existing applications
and infrastructure. DKA Encryption includes integrated key management functionality that is both
simple and safe to use.
DKA Encryption has the added benefit of being data center friendly: it uses very little additional
power (equivalent of a 25 watt light bulb), produces only negligible amounts of additional heat,
and requires no additional rack space.
DKA Encryption operations are performed using the Remote Web Console software for the P9500
storage system. The Security Administrator (View & Modify) role are required for DKA Encryption
operations. For information about Remote Web Console and the Security Administrator (View &
Modify) role, see the HP StorageWorks P9000 Remote Web Console User Guide.
Encryption specifications
SpecificationItem
Advanced Encryption Standard (AES) 256
bit.
Encryption algorithmHardware
specifications
XTS mode.Encryption mode
All volume types: open, mainframe,
multiplatform.
Volume typeEncryptable volume
All emulation types: OPEN-V, 3390-x, etc.Emulation type
Internal volumes only.Internal/external volumes
Supported. Requires data migration.Volume with existing data
Resources that can be executed for each function 5

SpecificationItem
Create keys by using Remote Web
Console.
Creation of encryption keyEncryption key
management
Delete keys by using Remote Web
Console. However, the key allocated to
the parity group cannot be deleted.
Deletion of encryption key
32 keys per storage system.Scope of encryption key
Parity group.Unit of encryption/decryption
Redundant (primary and secondary)
backup/restore copies (see “Encryption
key operations” (page 6)).
Backup/Restore functionality
Encryption key operations
The encryption key on the P9500 storage system is used to encrypt and decrypt data. The user
who has the Security Administrator (View & Modify) role can create encryption keys by using
Remote Web Console.
Up to 32 encryption keys can be created per storage system. However, HP recommends leaving
at least 2 keys unused at all times so there is room to change an existing key.
DKA Encryption provides redundant backup and restore operations for the encryption key to ensure
data availability.
Encryption key backup
DKA Encryption provides primary and secondary backup of the encryption key:
•Primary backup of the encryption key is executed automatically by the storage system. The
primary backup is stored on each DKA in the P9500 storage system.
•Secondary backup of the encryption key is performed by the user via Remote Web Console.
The secondary backup is required to restore the encryption key if the primary backup is
unavailable. The Security Administrator (View & Modify) role is required to back up the key.
The encryption key should be backed up immediately after it is created, and regular backups (e.g.,
once a week) should be scheduled to ensure data availability. For instructions, see “Backing up
the encryption key” (page 10).
CAUTION:
•If the primary backup becomes unavailable and there is no secondary backup, encrypted
data cannot be decrypted.
•The user is responsible for storing the secondary backup securely.
Encryption key restore
If the existing encryption key becomes unavailable or can no longer be used (e.g., due to a failure),
the key is restored from the primary or secondary backup copy:
•Restoring the encryption key from the primary backup is performed automatically by the storage
system.
•Restoring the encryption key from the secondary backup is performed by the user via Remote
Web Console. The Security Administrator (View & Modify) role is required to restore the key.
For instructions, see “Restoring the encryption key” (page 12).
6 About DKA Encryption

Data encryption operations
Data encryption
DKA Encryption provides data encryption at the parity-group level. First, encryption is enabled on
a parity group, and then the logical devices (LDEVs) in the parity group are formatted. This
encryption formatting operation writes encrypted zero data to the entire area of all drives in the
parity group.
Enabling data encryption is a destructive process. The user is responsible for backing up all data
in the parity group before enabling encryption. Encryption must be enabled before (encryption)
formatting operations can be performed.
The Security Administrator (View & Modify) role is required to enable encryption. For instructions,
see “Enabling data encryption” (page 11).
Encrypting existing data
Data migration is required to encrypt existing data on the P9500 storage system. First, a new
parity group is established and encryption is enabled, the encrypted parity group is formatted,
and then the existing data is migrated to the new LDEVs in the encrypted parity group. This data
migration is performed on a per-LDEV basis.
For information about data migration services, please contact your HP account team.
Disabling encryption
Disabling encryption is also performed at the parity-group level. First, encryption is disabled for a
parity group, and then the LDEVs in the parity group are formatted. This normal formatting operation
writes (unencrypted) zero data to the entire area of all drives in the parity group.
Disabling data encryption is a destructive process. The user is responsible for backing up all data
in the parity group before disabling encryption. Encryption must be disabled before (normal)
formatting operations can be performed.
The Security Administrator (View & Modify) role is required to disable encryption. For instructions,
see “Disabling data encryption” (page 12).
Changing the encryption key
Data migration is required to encrypt data with a different encryption key on the P9500 storage
system. First, a new parity group is established and encryption is enabled with a new encryption
key, the encrypted parity group is formatted, and then the existing data is migrated to the new
LDEVs in the encrypted parity group. This data migration is performed on a per-LDEV basis.
For information about data migration services, please contact your HP account team.
Audit logging of encryption events
The Audit Log feature of the P9500 storage system provides audit logging of key events that take
place on the array. Events related to DKA Encryption, including data encryption operations and
encryption key operations, are recorded in the audit log.
For information about audit logging and audit log events, see the HP StorageWorks P9000 Remote
Web Console User Guide and the HP StorageWorks P9000 Audit Log User Guide.
Data encryption operations 7

2 Preparing for DKA Encryption operations
This chapter provides information and instructions to prepare for DKA Encryption operations.
System requirements
RequirementItem
Microcode 70-01-0x and laterP9500
•DKA Encryption software license.
•Virtual LVI/LUN software.
The Security Administrator (View & Modify) role is required to enable and
disable data encryption.
The Security Administrator (View & Modify) role is required to back up
and restore the encryption key.
Remote Web Console
All open-systems and mainframe host platforms are supported.Host platforms
All volume types and emulations are supported: open-systems, mainframe,
and multiplatform.
Volumes must be internal. External volumes are not supported.
Data volumes
Interoperability considerations
Interoperability considerationsFunction
When a primary volume of a copy function is encrypted,
the secondary volume should also be encrypted. If not, the
copied data on the secondary volume is non-encrypted
data. In that case, the security of the data on the secondary
volume cannot be guaranteed.
Copy functions (Business Copy, Continuous Access
Synchronous, Compatible FlashCopy, Compatible XRC,
etc.)
When a primary volume is encrypted, the pool should
consist of only encrypted volumes. If the pool contains
non-encrypted volumes, the differential data of the primary
volume is stored as non-encrypted data. In that case, the
security of the data on the secondary volume cannot be
guaranteed.
When the encryption status of a primary volume and the
pool are not consistent (e.g., primary volume is not
encrypted and the pool consists of only encrypted volumes),
the secondary volume can consist of both encrypted and
non-encrypted data. To ensure data security, the primary
volumes and the pool must have the same encryption status.
Snapshot
When a primary volume is encrypted, the secondary
volume should also be encrypted. If not, the copied data
on the secondary volume is non-encrypted data. In that
case, the security of the data on the secondary volume
cannot be guaranteed.
When a primary volume is encrypted, use a journal to
which only encrypted volumes are registered as journal
volumes. If not, the journal in primary volume would be
stored as non-encrypted data, and so the security of the
data cannot be guaranteed. This also applies to secondary
volumes.
Continuous Access Journal
8 Preparing for DKA Encryption operations

Interoperability considerationsFunction
When a source volume of data migration is encrypted, the
target volume should also be encrypted. If not, the migrated
data on the target volume is non-encrypted data. In that
case, the security of the data on the target volume cannot
be guaranteed.
When performing encryption data migration for a LUSE
volume, migrate all LDEVs that constitute the LUSE volume.
If you perform encryption migration for only some LDEVs,
the LUSE volume would have both encrypted area and
non-encrypted area. In this case, the security of the data
cannot be guaranteed.
Migration functions
When storing encrypted data in a LUSE volume, use only
encrypted LDEVs. If you build a LUSE volume that consists
of encrypted LDEVs and non-encrypted LDEVs, the LUSE
volume would have both encrypted area and non-encrypted
area. In this case, the security of the data cannot be
guaranteed.
LUN Expansion (LUSE)
When encrypting data written to the pool via a virtual
volume, use a pool that consists of encrypted volumes.
Thin Provisioning
When a source volume of Data Exchange is encrypted,
the target volume should also be encrypted. If not, the data
on the target volume is non-encrypted data. In that case,
the security of the data on the target volume cannot be
guaranteed.
Data Exchange
Configuring Remote Web Console
Once you have verified that the requirements have been met, you are ready to configure Remote
Web Console for DKA Encryption operations.
To configure Remote Web Console for DKA Encryption operations
1. Log on to Remote Web Console.
2. Enable the DKA Encryption license key.
3. Assign the Security Administrator (View & Modify) role to the user who will be responsible for
backing up and restoring the encryption key.
For details of each operation, see the HP StorageWorks P9000 Remote Web Console User Guide.
Once the DKA Encryption license key has been enabled and the Security Administrator (View &
Modify) role has been assigned, you are ready to start DKA Encryption operations.
Configuring Remote Web Console 9

3 Performing DKA Encryption operations
Creating the encryption key
The encryption key can be created in preparation for the case where the change of the encryption
key is needed. Up to 32 encryption keys can be created per storage system. However, HP
recommends leaving at least 2 keys unused at all times so there is room to change an existing key.
Note that the encryption key cannot be created with the key ID that the encryption key has already
been created with.
To create the encryption key
1. Click Encryption Keys in the Administration tree.
2. Select the Encryption Keys tab on the right side of the window.
3. Select unused key ID.
4. On the menu bar, click Settings,Security,Encryption Keys, and then Create Keys. Or, select
Create Keys from the lower right of the window. The Create Keys window opens.
5. Confirm the settings and enter the task name in the Task Name box.
6. Click Apply in the Confirm window.
The task is registered. If the Go to tasks window for status check box is on, the Tasks window
appears.
For instructions on selecting the parity group and enabling the encryption, see “Enabling data
encryption” (page 11).
Backing up the encryption key
You should back up the encryption key immediately when it is created, and you should schedule
regular backups (for example, once a week) to ensure data availability.
The encryption key cannot be backed up when there is no encryption key. Moreover, confirm other
processing is not registered in the task when you back up the encryption key. When other processing
is registered in the task, the encryption key cannot be backed up.
CAUTION:
•If the primary backup becomes unavailable and there is no secondary backup, encrypted
data cannot be decrypted.
•The user is responsible for storing the secondary backup securely.
To back up the encryption key
1. Click Encryption Keys in the Administration tree.
2. Select the Encryption Keys tab on the right side of the window.
3. Select a encryption Key.
4. On the menu bar, click Settings,Security,Encryption Keys, and then Backup Keys. Or, select
Backup Keys from the lower right of the window. The Backup Keys window opens.
5. Type the desired password in Password. This password will be required to restore the encryption
key. The requirements for the password are:
•Length: minimum 6 characters, maximum 255 characters
•Valid characters:
◦numbers (0-9),
◦uppercase letters (A-Z)
10 Performing DKA Encryption operations

◦lowercase letters (a-z)
◦symbols: ! “ # $ % & ' ( ) * + , . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~
6. Type the password again in Re-enter Password for confirmation.
7. Click Finish to display the Confirm window.
8. Confirm the settings and enter the task name in the Task Name box.
9. Click Apply in the Confirm window.
The message which inform the completion of the preparation appears.
10. Click OK.
A window appears to save the backup file.
11. Select the location and type the desired name for the backup file.
The file extension must be .ekf.
12. Click Save to close the window.
You cannot cancel this. If the Go to tasks window for status check box in the Confirm window
is on, the Tasks window appears.
The user is responsible for the backup file and the password.
Enabling data encryption
You can enable data encryption on a parity group only when all volumes in the parity group can
be formatted (that is, blocked status). If there are any volumes that cannot be formatted, encryption
cannot be enabled.
To enable data encryption
1. Click Parity Groups in the Storage Systems tree.
Internal or External appear in the tree.
2. Select the Parity Groups tab on the right side of the window, or select Internal from the tree
and then select the Parity Groups tab on the right side of the window.
3. Select a parity group.
When the parity group is not selected, you can enable data encryption on all the parity groups.
4. On the menu bar, click Actions,Parity Group, and then Edit Encryption. Or, select Edit
Encryption from the lower right of the window. The Edit Encryption window opens.
5. Select the parity group on which you want to enable data encryption from the Available
Groups list, select the key ID from Encryption Key, and then select the format type from Format
Type.
6. Click Add.
The parity group which is selected from the Available Parity Groups list is displayed in the
Selected Parity Groups list.
7. Click Finish to display the Confirm window.
8. Confirm the settings and enter the task name in the Task Name box.
9. Click Apply in the Confirm window. A message appears asking whether to apply the setting
to the storage system.
10. Click OK to close the message.
The setting is applied to the storage system. If the Go to tasks window for status check box in
the Confirm window is on, the Tasks window appears.
Enabling data encryption 11

Disabling data encryption
You can disable data encryption on a parity group only when all volumes in the parity group can
be formatted (that is, blocked status). If there are any volumes that cannot be formatted, encryption
cannot be disabled.
To disable data encryption
1. Click Parity Groups in the Storage Systems tree.
Internal or External appear in the tree.
2. Select the Parity Groups tab on the right side of the window, or select Internal from the tree
and then select the Parity Groups tab on the right side of the window.
3. Select a parity group.
When the parity group is not selected, you can disable data encryption on all the parity
groups.
4. On the menu bar, click Actions,Parity Group, and then Edit Encryption. Or, select Edit
Encryption from the lower right of the window. The Edit Encryption window opens.
5. Select the parity group on which you want to disable data encryption from the Available Parity
Groups list, select Disable from Encryption Key, and then select the format type from Format
Type.
6. Click Add.
The parity group which is selected from the Available Parity Groups list is displayed in the
Selected Parity Groups list.
7. Click Finish to display the Confirm window.
8. Confirm the settings and enter the task name in the Task Name box.
9. Click Apply in the Confirm window. A message appears asking whether to apply the setting
to the storage system.
10. Click OK to close the message.
The setting is applied to the storage system. If the Go to tasks window for status check box in
the Confirm window is on, the Tasks window appears.
Restoring the encryption key
If the encryption key and primary backup copy are not available or cannot be used (for example,
due to failure), encrypted user data becomes unreadable. In this case you must restore the encryption
key from the secondary backup copy.
To restore the encryption key
1. Click Encryption Keys in the Administration tree.
2. Select the Encryption Keys tab on the right side of the window.
3. Select an encryption key.
4. On the menu bar, click Settings,Security,Encryption Keys, and then Restore Keys. Or, select
Restore Keys from the lower right of the window. The Restore Keys window opens.
5. Click Browse.
The message which informs you about the completion of the preparation appears.
6. Click OK.
A window appears to select the backup file.
7. Select the backup file.
12 Performing DKA Encryption operations

8. Click Open to close the window.
The name of the selected file appears in File Name in the Restore Keys window.
9. Type the password for the encryption key in Password. This is the password that was entered
when the selected key was backed up.
10. Click Finish to display the Confirm window.
11. Confirm the settings and enter the task name in the Task Name box.
12. Click Apply in the Confirm window.
The task is registered. If the Go to tasks window for status check box is on, the Tasks window
appears.
Deleting the encryption key
To delete the encryption key
1. Click Encryption Keys in the Administration tree.
2. Select the Encryption Keys tab on the right side of the window.
3. Select a encryption Key.
The uncreated encryption key, or the encryption key allocated to the parity group cannot be
deleted.
4. On the menu bar, click Settings,Security,Encryption Keys, and then Delete Keys. Or, select
Delete Keys from the lower right of the window. The Delete Keys window opens.
5. Confirm the settings and enter the task name in the Task Name box.
6. Click Apply in the Confirm window. A message appears asking whether to apply the setting
to the storage system.
7. Click OK.
The task is registered. If the Go to tasks window for status check box in the Confirm window
is on, the Tasks window appears.
Deleting the encryption key 13

4 Troubleshooting
This chapter provides troubleshooting information for DKA Encryption.
Troubleshooting
For troubleshooting information about the P9500 storage system, see the HP StorageWorks P9500
Owner Guide.
For troubleshooting information about Remote Web Console, see the HP StorageWorks P9000
Remote Web Console User Guide and HP StorageWorks P9000 Remote Web Console Messages.
The following table provides general troubleshooting information for DKA Encryption operations.
Table 1 General troubleshooting
ActionProblem
Verify the following:
•The DKA Encryption is enabled and not expired.
•The Security Administrator (View & Modify) role is
assigned.
Cannot access encryption key operations (backup/restore
key).
Verify the following:
•The DKA Encryption is enabled and not expired.
•The Security Administrator (View & Modify) role is
assigned.
Cannot create/delete encryption keys.
Verify the following:
•The DKA Encryption is enabled and not expired.
•All volumes in the parity group are in the blocked status.
Cannot enable encryption for a parity group.
Verify that all volumes in the parity group are in the blocked
status.
Cannot disable encryption for a parity group.
Verify the following:
•The DKA Encryption is enabled and not expired.
•The Security Administrator (View & Modify) role is
assigned.
Cannot restore the encryption key.
14 Troubleshooting

5 Support and other resources
Contacting HP
For worldwide technical support information, see the HP support website:
http://www.hp.com/support
Before contacting HP, collect the following information:
•Product model names and numbers
•Technical support registration number (if applicable)
•Product serial numbers
•Error messages
•Operating system type and revision level
•Detailed questions
Subscription service
HP recommends that you register your product at the Subscriber's Choice for Business website:
http://www.hp.com/go/e-updates
After registering, you will receive e-mail notification of product enhancements, new driver versions,
firmware updates, and other product resources.
Documentation feedback
HP welcomes your feedback.
To make comments and suggestions about product documentation, please send a message to
[e-mail]. Include the document title and manufacturing part number. All
submissions become the property of HP.
Related information
The following documents [and websites] provide related information:
•HP StorageWorks P9000 Performance for Open and Mainframe Systems User Guide
•HP StorageWorks P9000 Owner Guide
•HP StorageWorks P9000 Remote Web Console Messages
•HP StorageWorks P9000 Remote Web Console User Guide
You can find these documents on the Manuals page of the HP Business Support Center website:
http://www.hp.com/support/manuals
In the Storage section, click Disk Storage Systems for hardware or Storage Software for software,
and then select your product.
HP websites
For additional information, see the following HP websites:
•http://www.hp.com
•http://www.hp.com/go/storage
•http://www.hp.com/service_locator
Contacting HP 15

•http://www.hp.com/support/manuals
•http://www.hp.com/support/downloads
•http://www.hp.com/storage/whitepapers
Conventions for storage capacity values
P9000 disk arrays use the following values to calculate physical storage capacity values (hard
disk drives):
•1 KB (kilobyte) = 1,000 bytes
•1 MB (megabyte) = 1,0002bytes
•1 GB (gigabyte) = 1,0003bytes
•1 TB (terabyte) = 1,0004bytes
•1 PB (petabyte) = 1,0005bytes
•1 EB (exabyte) = 1,0006bytes
P9000 disk arrays use the following values to calculate logical storage capacity values (logical
devices):
•1 KB (kilobyte) = 1,024 bytes
•1 MB (megabyte) = 1,0242bytes
•1 GB (gigabyte) = 1,0243bytes
•1 TB (terabyte) = 1,0244bytes
•1 PB (petabyte) = 1,0245bytes
•1 EB (exabyte) = 1,0246bytes
Typographic conventions
Table 2 Document conventions
ElementConvention
Cross-reference links and e-mail addressesBlue text: Table 2 (page 16)
Website addressesBlue, underlined text: http://www.hp.com
•Keys that are pressed
•Text typed into a GUI element, such as a box
•GUI elements that are clicked or selected, such as menu
and list items, buttons, tabs, and check boxes
Bold text
Text emphasisItalic text
•File and directory names
•System output
•Code
•Commands, their arguments, and argument values
Monospace text
•Code variables
•Command variables
Monospace, italic text
Emphasized monospace textMonospace, bold text
16 Support and other resources

WARNING! Indicates that failure to follow directions could result in bodily harm or death.
CAUTION: Indicates that failure to follow directions could result in damage to equipment or data.
IMPORTANT: Provides clarifying information or specific instructions.
NOTE: Provides additional information.
TIP: Provides helpful hints and shortcuts.
Typographic conventions 17

A DKA Encryption GUI reference
This chapter describes the Remote Web Console windows and dialog boxes for DKA Encryption.
For information about common operation such as buttons and task entry, see the HP StorageWorks
P9000 Remote Web Console User Guide.
Top window when selecting encryption keys
This window appears when you select Encryption Keys in Administration.
Summary
DescriptionItem
Number of encryption keys.Number of Encryption Keys
Number of encryption keys for internal volumes.Internal
Encryption Keys tab
DescriptionItem
IDs of encryption keys.Key ID
The time when an encryption key is created.Last Update Date
Types of encryption keys.
When the key ID is 0 to 31, Internal is displayed.
Type
18 DKA Encryption GUI reference

DescriptionItem
The number of times that an encryption key is created.Number of Creations
The number of times that a backup of an encryption key is created.Number of Backups
Displays whether the encryption key is used.Used
Displays the Create Keys window.Create Keys
Displays the Backup Keys window.Backup Keys
Displays the Restore Keys window.Restore Keys
Displays the Delete Keys window.Delete Keys*
* You can see the item on the menu that appears by clicking More Actions.
Create Keys window
Selected Keys table
DescriptionItem
IDs of encryption keys.Key ID
Types of encryption keys.
When the key ID is 0 to 31, Internal is displayed.
Type
Create Keys window 19

Backup Keys wizard
Backup Keys window
Password field
Type the password for the encryption key. The password must be at least 6 characters and up to
255 characters. The valid characters are:
•Numbers (0 to 9)
•Upper case (A-Z)
•Lower case (a-z)
•Symbols: ! “ # $ % & ' ( ) * + , . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~
Re-enter Password field
Type the password again for confirmation.
Confirm window
Task Name field
Enter the task name. A task name can consist of up to 32 ASCII characters (letters, numerals, and
symbols). Task names are case-sensitive. (date) - (task name) is input by default.
20 DKA Encryption GUI reference