Spectra Logic Spectra BlueScale Vision User manual

BlueScale™Encryption
User Guide
PN 90940012 Revision E

Notices
Unless specifically negotiated and except as expressly stated herein, Spectra Logic Corporation makes available its products and
associated documentation on an “AS IS” BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUD-
ING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, BOTH OF
WHICH ARE EXPRESSLY DISCLAIMED. In no event shall Spectra Logic be liable for any loss of profits, loss of business, loss of use
or data, interruption of business, or for indirect, special, incidental or consequential damages of any kind, even if Spectra Logic
has been advised of the possibility of such damages arising from any defect or error.
Information furnished in this manual is believed to be accurate and reliable. However, no responsibility is assumed by Spectra
Logic for its use. Due to continuing research and development, Spectra Logic may revise this publication from time to time with-
out notice, and reserves the right to change any product specification at any time without notice.
If you do not agree to the above, do not use the Spectra library; instead, promptly contact Spectra Logic for instructions on how to
return the library for a refund.
Copyright ©2007 Spectra Logic Corporation. All rights reserved worldwide.
License
You have acquired a Spectra library that includes software owned or licensed by Spectra Logic from one or more software
licensors (“Software Suppliers”). Such software products, as well as associated media, printed materials and “online” or
electronic documentation (“SOFTWARE”) are protected by copyright laws and international copyright treaties, as well as other
intellectual property laws and treaties.
If you do not agree to this end user license agreement (EULA) or to the terms and conditions under Notices above, do not use
the Spectra library; instead, promptly contact Spectra Logic for instructions on return of the Spectra library for a refund. Any
use of the Software, including but not limited to use on the Spectra library, will constitute your agreement to this EULA (or
ratification of any previous consent).
Grant of License. The Software is licensed on a non-exclusive basis, not sold. This EULA grants you the following rights to the
Software:
• You may use the Software only on the Spectra library.
•Not Fault Tolerant. The Software is not fault tolerant. Spectra Logic has independently determined how to use the Software in
the Spectra library, and suppliers have relied upon Spectra Logic to conduct sufficient testing to determine that the Software
is suitable for such use.
•No Warranties for the SOFTWARE. The Software is provided “AS IS” and with all faults. The entire risk as to satisfactory qual-
ity, performance, accuracy, and effort (including lack of negligence) is with you. Also, there is no warranty against interference
with your enjoyment of the Software or against infringement. If you have received any warranties regarding the SOFTWARE,
those warranties do not originate from, and are not binding on Software suppliers.
•Note on Java Support. The Software may contain support for programs written in Java. Java technology is not fault tolerant and
is not designed, manufactured, or intended for use of resale as online control equipment in hazardous environments requiring
fail-safe performance, such as in the operation of nuclear facilities, aircraft navigation or communications systems, air traffic
control, direct life support machines, or weapons systems, in which the failure of Java technology could lead directly to death,
personal injury, or severe physical or environmental damage.
•No Liability for Certain Damages. Except as prohibited by law, Software suppliers shall have no liability for any indirect, spe-
cial, consequential or incidental damages arising from or in connection with the use or performance of the Software. This limi-
tation shall apply even if any remedy fails of its essential purpose. In no event shall Software suppliers, individually, be liable
for any amount in excess of U.S. two hundred fifty dollars (U.S. $250.00).
•Limitations on Reverse Engineering, Decompilation, and Disassembly. You may not reverse engineer, decompile, or disas-
semble the Software, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding
this limitation.
•Software Transfer Allowed with Restrictions. You may permanently transfer rights under this EULA only as part of a perma-
nent sale or transfer of the Spectra library, and only if the recipient agrees to this EULA. If the Software is an upgrade, any
transfer must also include all prior versions of the Software.
•Export Restrictions. Export of the Software from the United States is regulated by the Export Administration Regulations (EAR,
15 CFR 730-744) of the U.S. Commerce Department, Bureau of Export Administration. You agree to comply with the EAR in the
export or re-export of the Software: (i) to any country to which the U.S. has embargoed or restricted the export of goods or
services, or to any national or any such country, wherever located, who intends to transit or transport the Software back to
such country; (ii) to any person or entity who you know or have reason to know will utilize the Software or portion thereof in
the design, development or production of nuclear, chemical, or biological weapons; or (iii) to any person or entity who has
been prohibited from participating in U.S. export transactions by any federal agency of the U.S. government. You warrant and
represent that neither the BXA nor any other U.S. federal agency has suspended, revoked or denied your export privileges. For
additional information see http://www.microsoft.com/exporting/.

3
Contents
Chapter 1. Introduction
About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Shipped Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
BlueScale Encryption Overview
Chapter 2. Encryption Architecture & Strategies
BlueScale Encryption Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Site-Specific Decisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Site Security Example: Low Security Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Site Security Example: Medium Security Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Site Security Example: High Security Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Before You Begin Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Summary: Mandatory Security Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Spectra T950 and T120 BlueScale Encryption
Chapter 3. Installing and Activating Encryption in Spectra T950 and T120 Libraries
Installing Encryption: Upgrading Your Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Activating Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Next Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

.
4
Chapter 4. Using Standard Edition in Spectra T950 and T120 Libraries
Using Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Configuring Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Creating an Encryption Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Assigning a Key to a Partition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Protecting Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Deleting a Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Restoring Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Chapter 5. Using Professional Edition in Spectra T950 and T120 Libraries
Using Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Professional Edition Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Configuring Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Creating an Encryption Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Assigning a Key to a Partition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Protecting Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Restoring Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Deleting a Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Chapter 6. Recycling Encrypted LTO-4 Media in Spectra T950 and T120 Libraries
Recycling Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

.
5
Spectra T50
BlueScale Encryption
Chapter 7. Installing and Activating Encryption in Spectra T50 Libraries
Installing Encryption: Upgrading Your Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Activating Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Next Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Encryption Icon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
BlueScale Encryption Editions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Data to Encrypt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Media Recycling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Chapter 8. Using Standard Edition in Spectra T50 Libraries
Using Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Restoring Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Recycling Encrypted Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Chapter 9. Using Professional Edition in Spectra T50 Libraries
Using Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Professional Edition Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Configuring Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Creating an Encryption Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Assigning a Key to a Partition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Restoring Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Chapter 10. Recycling Encrypted Media in Spectra T50 Libraries
Recycling Encrypted Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

.
6
EDU
and
BlueScale Encryption Support
Chapter 11. Endura Decryption Utility
Endura Decryption Utility Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Decrypting Data: EDU Command Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Using EDU to Decrypt Data: One Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Using EDU to Decrypt Data: Two Drives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Restoring Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Chapter 12. Technical Support & Spectra Logic Contact Information
BlueScale Encryption Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Contacting Spectra Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131
Index 132

7
1 Introduction
About This Guide
This guide contains information about BlueScale Encryption for Spectra T950, T120, and T50
libraries. This reviews information on the configuration and use of encryption. Note that the
encryption procedures for the Spectra T950 and T120 libraries cover both library-based and
drive-based encryption; the Spectra T50 library supports drive-based encryption only.
The guide has been divided into the following sections:
BlueScale Encryption Overview on page 10 reviews both encryption best practices and
information on using BlueScale Encryption and key management on your site, and
includes a short glossary.
Spectra T950 and T120 BlueScale Encryption on page 26 reviews using Spectra T950/T120
BlueScale Encryption and key management.
Spectra T50 BlueScale Encryption on page 71 reviews using Spectra T50 BlueScale
Encryption and key management.
EDU and BlueScale Encryption Support on page 123 reviews an optional utility that lets
you recover data without a library; this section also provides support information.
Intended Audience
This guide assumes that you are familiar with data backup and data protection strategies.

1. Introduction
8
Related Publications
This guide outlines the configuration and use of BlueScale Encryption software in your
Spectra library.
For detailed information on the configuration and use of the library itself, see the Spectra
Logic publications specific to your library.
• The library’s user guide describes the configuration and use of the library, including
specifications and troubleshooting information.
•Thelibrary’s release notes provide the most up-to-date information about the library,
drives, and media.
The most up-to-date versions of all library documentation are available on Spectra Logic’s
Web site at www.SpectraLogic.com.
Conventions Used in this Guide
Important information is called out as follows:
Note: Provides additional points or suggestions.
Caution: Provides information about how to avoid damage to equipment.
Warning: Describes ways to avoid personal injury.
A caret (>) describes a series of menu selections. For example:
Select Configuration > Network
means
Select Configuration, then select Network.

1. Introduction
9
Shipped Items
The following items are included with the purchase of BlueScale Encryption:
• One encryption activation key
• One software support agreement
•Thisuserguide
•Onet-shirt
If you ordered the Endura®Decryption Utility (EDU), you also receive one EDU CD.

BlueScale Encryption
Overview