DPX 4.10 Guide
Catalogic SoftwareKnowledge BaseMySupport
  • Welcome to DPX!
  • Introduction
    • About DPX
  • Installation and Configuration
    • How to Start – Basic Configuration
    • DPX Master Server
      • Deploying DPX with VMware vSphere
      • Deploying DPX with Microsoft Hyper-V
      • DPX Master Server Interface
      • Configuration
    • DPX Client
      • DPX Client for Microsoft Windows
        • Requirements
        • Installation
        • How to Uninstall
      • DPX Client for Linux
        • Requirements
        • Installation
        • How to Uninstall
      • Automated Deployment of DPX Client
      • Further Actions with DPX Client
    • DPX Proxy Server
      • Deploying DPX Proxy Server for VMware
      • DPX Proxy Server Web Interface
    • DPX Hyper-V Agent
    • Nodes
      • Adding a Client Node to the Master Server during Client Deployment
      • Adding a Client Node from the Master Server Level
      • Adding a Configured Hyper-V Host as a DPX Node
      • Adding Other Node Types to the Master Server
      • Adding a Node Group
    • Devices
      • Adding a Device Cluster
      • Adding a Device
      • Adding a Tape Library
      • Adding a Tape Library Device
    • Media
      • Adding a Media Pool
      • Adding Media Volumes
    • Tape Libraries
      • Tape Library Deployment
      • Tape Library Setup
      • Manual Tape Library Installation
      • Tape Library Verification
      • Manual Tape Library Configuration
      • Setting up LTO Tape Drives for Hardware Encryption
      • Assigning and Unassigning Media to/from Tape Library Slots
    • User Configuration
      • Configure Administrators Window
    • Other Components of the DPX Suite
    • Updating DPX
      • Command Line Update
      • Online Autoupdate Method
      • Offline Autoupdate Method
  • Backup
    • Introduction and Backup Types
    • File Backup
      • Creating a File Backup Job
        • Job Source Options for File Backup
        • Job Destination Options for File Backup
        • Other Job Options for File Backup
      • Editing a File Backup Job
      • Scheduling a File Backup Job
    • Block Backup
      • Prerequisites
      • Creating a Block Backup Job
        • Job Options for Block Backup
      • Editing a Block Backup Job
      • Scheduling a Block Backup Job
      • Forcing a Base Backup
      • Backing up System State
      • Backing up System Table
    • Application Backup
      • Microsoft SQL Server Backup
        • Creating a Microsoft SQL Server Backup Job
      • Microsoft Exchange Server Backup
        • Creating a Microsoft Exchange Server Backup Job
      • Microsoft SharePoint Server Backup
        • Creating a Microsoft SharePoint Server Backup Job
      • Oracle Database Backup
        • Creating an Oracle Database Backup Job
      • SAP HANA Backup
        • Running SAP HANA Backup Job
      • OpenText GroupWise Backup
        • Creating a GroupWise Backup Job
    • Bare Metal Recovery (BMR) Backup
      • Creating a BMR Backup Job
    • Catalog Backup
      • General Considerations
      • Creating a Catalog Backup Job
        • Job Options for Catalog Backup
      • Editing a Catalog Backup Job
      • Scheduling a Catalog Backup Job
    • NDMP Backup (desktop interface only)
      • Prerequisites
      • Creating an NDMP Backup Job
        • Job Source Options for NDMP Backup
        • Job Destination Options for NDMP Backup
        • Other Job Options for NDMP Backup
      • Editing an NDMP Backup Job
      • Scheduling an NDMP Backup Job
    • Image Backup (desktop interface only)
      • Creating an Image Backup Job
      • Editing an Image Backup Job
      • Scheduling an Image Backup Job
    • Agentless Backup for VMware and Hyper-V
      • Agentless Backup for VMware
        • Agentless Backup for VMware Complements Block Data Protection
        • Agentless VMware Backup Architecture and Data Flow
        • Environmental Requirements for Agentless VMware Backup
        • Best Practices for Agentless VMware Backup
        • Creating an Agentless VMware Backup Job
          • Job Source Options for Agentless VMware Backup
          • Other Job Options for Agentless VMware Backup
        • Editing an Agentless VMware Backup Job
        • Scheduling a VMware Backup Job
        • Application-Consistent Protection
        • Architecture and Data Flow
      • Agentless Backup for Microsoft Hyper-V
        • Creating a Hyper-V Backup Job
        • Editing a Hyper-V Backup Job
        • Scheduling a Hyper-V Backup Job
    • Condense
      • Starting a Condense Job
      • Scheduling a Condense Job (desktop interface only)
    • File Exclusion Rules
    • Pre-Scripts and Post-Scripts
    • Differential and Incremental Backups
    • Archive
      • Creating an Archive Job for Block Backup
      • Creating an Agentless VMware Archive Job
  • Restore
    • Introduction and Restore Modes
    • Restore Modes in the Web Interface
      • Agentless File Restore
      • Full VM Restore for VMware
      • Full VM Restore for Hyper-V
      • Instant VM Restore
      • Agent-Based File Restore
        • Advanced Job Options
      • Instant Access
      • Virtualization
      • Application Restore
        • Microsoft SQL Server Restore
        • Microsoft Exchange Server Restore
        • Microsoft Sharepoint Server Restore
        • Oracle Database Restore
        • SAP HANA Restore
        • OpenText GroupWise Restore
      • Restoring files protected by file backup jobs
        • Job Options for Restoring files protected by file backup jobs
    • Restore Modes in the Desktop Interface
      • File Restore
        • Creating a File Restore Job
      • Image Restore
        • Creating an Image Restore Job
      • NDMP Restore
        • Creating an NDMP Restore Job
      • Block Restore
        • Creating a Block Restore Job
        • Specifying Mount Points
        • Restoring Block Data with Instant Access
        • Restoring BMR Data with Virtualization
      • Agentless VMware Restore
        • Creating an Agentless VMware Restore Job
          • Agentless VMware Restore Job Operations
        • Rapid Return to Production (RRP)
      • Tape Restore
        • Creating a Tape Restore Job
      • Application Restore
      • Scheduling a Restore Job in the Desktop Interface
        • Previewing Scheduled Jobs in the Desktop Interface
      • Restore Job Source Options
    • Catalog Restore
      • Creating a Catalog Restore Job
    • Bare Metal Recovery (BMR) Restore
    • Recovering Archived Backups
      • Recovering a VMware Archive
  • Storage
    • Backup Destinations
    • Tape Storage
    • vStor
    • Disk Directory
    • NetApp
    • OSS
    • Cloud Storage
      • Registering AWS S3 Cloud Storage
      • Registering a Generic Cloud Storage
  • Web Interface
    • Log-in Page
    • Dashboard
    • Job Monitor
    • Job Manager
    • Schedule Overview
    • Reports
      • Reports Templates
    • Nodes
    • Devices & Pools
    • Events
    • Configuring Enterprise Information
  • Desktop Interface
    • Connect to DPX Window
    • Main Window
    • Common Menu Bar Options
    • Function Tabs Desktop Interface
      • Backup Tab
      • Restore Tab
      • Monitor Jobs Tab
      • Control Devices Tab
      • Reports Tab
      • Catalog Tab
      • Copy Tab
      • Manage Tapes Tab
      • Configure Tab
      • [Legacy] Analytics Tab
    • Common Function Window Tasks
    • Configuring Parameters
    • Configuring the Enterprises
      • Editing an Enterprise Configuration
    • Configuring Devices
  • BARE METAL RECOVERY
    • Bare Metal Recovery Overview
    • Bare Metal Recovery for Windows
    • Bare Metal Recovery for Linux
    • Recovery from a Replicated or Alternate Data Resource
  • Miscellaneous
    • Configuring Keyrings
      • Adding a Keyring
      • Adding a Key
    • Getting Node Information
    • SNMP Interface
    • Troubleshooting
      • Troubleshooting Installation of the Catalogic DPX Client on UNIX and UNIX-like Systems
    • Technical Support
    • Terminology
    • Acronyms
    • Default Ports
    • Managing Licenses
Powered by GitBook
On this page
  • General Considerations
  • Encryption Considerations for Database Applications
  • Software Encryption versus Hardware Encryption
  • Job Options

Was this helpful?

Export as PDF
  1. Miscellaneous

Configuring Keyrings

Last updated 6 months ago

Was this helpful?

General Considerations

Keyrings are groupings of DPX keys. These keys are used to derive actual encryption keys for data-encrypted jobs. Each key in a keyring is assigned to a period when it is applicable for backup and migrate jobs. At any time, only one key in a keyring is applicable. The other keys in a keyring, although retired, may still be needed for restore and migrate jobs.

A keyring, in turn, is a resource that gets assigned to an administrator group. See . When a job is run, the administrator who creates that job must belong to an administrator group containing the keyring that holds the encryption key.

For restore jobs, the same key that was used for backup must be used for restoring the data. Keyring information is recorded along with an encrypted backup instance on the tape volume, so DPX knows which key to use for restore. As with other types of jobs, the keyring specified on the restored media must be assigned to the administrator who created the restore job.

For migrate jobs, the same key that would have been used for the original backup jobs is used for encryption. If an original backup job used encryption, then its data is not re-encrypted during migrate. This means that in order to encrypt the data during migrate, you must have created a keyring and a key before the original backup jobs were run.

Note. It is highly recommended that hardware compression on the tape devices be turned off if you intend to use migrate to create twin tapes after the backup has been completed. This is because encrypted data is hard to compress; thus the resulting data (on tape) will be much greater for the twin than the original if hardware compression is used. If the resulting data exceeds the storage capacity of the target tape, then the migrate job will fail.

The reason for multiple keys on a keyring is to mitigate the effect of compromising an existing key or losing a set of tapes. For example, if the key database is compromised (e.g., stolen), an administrator can simply generate a new key for each keyring to protect all future jobs. For another example, if a tape corresponding to a particular key is stolen, the administrator can generate a new key in its place and delete that previous key to prevent it from being compromised. Note that deleting a key effectively expunges all the backup instances that were encrypted with that key.

See also. For the latest system compatibility details regarding supported hardware, file systems, applications, operating systems, and service packs, see the .

Encryption Considerations for Database Applications

Tape encryption of DB2 and Oracle backups requires editing the parameter file job_name.BEX (Windows) or sbt11cfg.BEX (UNIX) in the product directory and setting the following parameters:

BEX_EDOT

Values are N (no), B (both), O (original), T (twin).

BEX_ENCTYPE

Values are S (software) or H (hardware).

BEX_EKRN

Value is the keyring name.

Software Encryption versus Hardware Encryption

DPX provides AES 256-bit software encryption. However, certain tape devices can encrypt data at the hardware level. DPX supports hardware encryption for LTO tape drives of specific types and manufacturers.

Hardware encryption utilizes keyrings for backups and restores in the same way that software encryption does. A job option allows the user to indicate whether to use software or hardware encryption.

The following are additional considerations for hardware encryption:

  • The user is responsible for assuring the hardware encryption capabilities of their tape devices.

  • You can use one media pool for both types of tape devices (hardware encryption capable and hardware encryption incapable), but it is better to use separate media pools.

  • You can use the same keyring for jobs with software encryption or hardware encryption. However, there is a length limitation (10 bytes) for the keyring name in hardware encryption.

  • You cannot use the same tape for backup jobs with and without the hardware encryption option. DPX selects a suitable tape automatically.

  • To verify whether a tape is encrypted or not, use the utility tools/tapedump. First, run the program tapedump. Second, issue tape deviceName command. Third, issue open rdonly command. Fourth, issue read command several times. If you hit a read permission error, then the tape is encrypted.

Job Options

Data encryption is an option that can be enabled by setting the Encrypt Data job option when defining a file backup job.

See also. For the latest system compatibility details regarding supported hardware, file systems, applications, operating systems, and service packs, see the .

See also. To read more about the encryption options and how to set them in File Backup jobs, go to .

DPX 4.10 Compatibility Matrix
Other Job Options for File Backup
DPX 4.10 Compatibility Matrix
Assigning Resources and Privilege Classes