The IBM System Storage TS1120, TS1130 and TS1140 tape drives support drive-based data encryption to protect your data.
This blog entry is related to the encryption key manger, that is required dependent on the tape device, if you want use drive-based data encryption.
For the TS1120 and TS1130 you may use the IBM Encryption Key Manager (EKM) component, a Java program, to manage encryption keys. The EKM and the tape drive communicate via the TCP/IP protocol.
For the TS1140 you have to use the IBM Security Key Lifecycle Manager (SKLM) to manage encryption keys. SKLM can also manage the keys for TS1120 and TS1130.
Both EKM and SKLM provide the Key Encryption Key Labels (KEKLs) required for the z/VSE Job Control KEKL statement.
A job running on z/VSE can issue a request to encrypt the data to be stored on tape. This request is initiated using the appropriate mode setting in the Job Control ASSGN statement and the Job Control KEKL statement.
More information of the IBM Security Key Lifecycle Manager (SKLM) is here.