TS7770 Disk Encryption for 3956-CSB

Abstract

The IBM Virtualization Engine TS7700 Series is the latest in the line of tape virtualization products that has revolutionized the way mainframe customers utilize their tape resources. Security of the information stored on the internal disk subsystem used to virtualize tape has become important to many customers. The TS7770 (collectively called TS7700 hereon) internally use a disk encryption to store or cache virtual tape volumes. The IBM TS7700 disk subsystem model 3956-CSB have been enhanced to support disk encryption, 3956-CSB was introduced from TS7700 8.50.0.134. Additionally, these subsystem model support externally managed disk encryption of data at rest. This support protects against the potential exposure of sensitive user data and user metadata that is stored on discarded, lost, or stolen storage devices. The 3956-CSB supports IBM Security Key Lifecycle Manager server to handle key management on the cache (called External Encryption enablement) and USB flash drives to enable encryption and copy a key to the cache (called Local Encryption enablement). This white paper describes the general use of the data encryption on 3956-CSB disk storage subsystem when used in the TS7700 Virtualization Engine (VE).