Brocade Communications Systems Encryption Switch Service Manual download pdf (Page 251)

Fabric OS Encryption Administrator’s Guide (DPM) 233

53-1002720-02

Tape data compression

Data is compressed by the encryption switch or blade before encrypting only if the tape device

supports compression, and compression is explicitly enabled by the host backup application. That

means if the tape device supports compression, but is not enabled by the host backup application,

then compression is not performed by the encryption switch or blade before encrypting the data.

However, if the backup application turns on compression at the tape device and does not turn it off

before logout or after the backup or restore operation is complete, and a second host backup

application starts using the same tape device and does not explicitly turn off compression,

compression will still be on when the encryption switch or blade issues a Mode Sense command to

find target device capabilities, and compression is used. In other words, if the host backup

application does not turn off compression on the target, the encryption switch or blade uses the

compression feature of the target. Conversely, if the tape device does not support compression,

the encryption switch or blade does not perform compression before encrypting the data. The

same rules apply for decompression.

Data is compressed, encrypted and padded with ASCII 0 to the tape block length to simplify

handling at the encryption device. It is assumed that a tape target with compression enabled will

be unable to compress the seemingly random encrypted data, but will greatly compress the

padded zero data that follows. Compressing data at the encryption device in conditions other than

above does not create any additional space savings on the tape media.

Tape pools

When a new tape pool needs to be created, the following steps must be performed:

• Configure the tape pool with a maximum of 64 bytes of tape pool label first on the encryption

device. The tape pool label configured on the encryption device must be an exact match to the

tape pool label (or number) configured on the tape backup application.

• Set the policies (such as encrypt or cleartext), format (such as native Brocade format or

DF-compatible), and optionally specify a key life span for the tape pool.

Tape pools are unique across an encryption group. Tape pool configuration takes precedence over

LUN level configuration.

Tape pool configuration is used only when labeling of tape media is done on the first write for the

tape media. After tape labeling is done and metadata written, the tape pool configuration is no

longer used. Tape pool configuration is not required for restoring data from the encrypted tape

belonging to the tape pool, because the key ID is present in the metadata.

When the tape pool label configured on the encryption device does not match with any label that

the backup application sends as part of the first write (tape labeling) to the tape media, the tape

pool level policies are ignored and default LUN level policies are applied.

1 2 ... 246 247 248 249 250 251 252 253 254 255 256 ... 325 326

No comments

Brocade Communications Systems Encryption Switch Service Manual Page 251