8464ch07_Upgrade.fm Draft Document for Review February 7, 2020 3:15 pm GLYPH<SM590000> Data encryption keys (one for each encrypted object): – Data encryption keys are used to encrypt data. When an encrypted object (such as an  array, pool, or child pool) is created, a new data encryption key is generated for this  object. – Managed disks (MDisk) that are not self-encrypting are automatically encrypted by  using the data encryption key of the pool or child pool to which they belong. – MDisks that are self-encrypting are not reencrypted by using the data encryption key of  the pool or child pool they belong to by default. You can override this default by  manually configuring the MDisk as not self-encrypting. – Data encryption keys are st ored in secure memory. – During cluster internal communication da ta encryption keys are encrypted with the  master access key. – Data encryption keys cannot be viewed or changed. – When an encrypted object is deleted, its data encryption key is discarded (secure  erase). Note:  If all master access key copies are lost and the system must cold restart, all  encrypted data is gone. No method exists, even for IBM, to decrypt the data without  the keys. If encryption is enabled and the system cannot access the master access  key, all SAS hardware is offline, including unencrypted arrays. The TS7700 can use external key management with 3956-CSA and 3956-CSB cache types.  With 3956-CSA. Feature codes 5276 and 5277 are required to enable the external  management. The 3956-CSB cache requires FC 5276 to enable external management.  Systems that are set up with Local encryption key management can be converted to external  key management. Back-end drive 16 Gbps fibre switch  Note:  Only the distributed IBM Security Key Lifecycle Manager (SKLM) supports both  external disk encryption and TS1140 and TS1150 tape drives. The settings for Encryption  Server are shared for both tape and external disk encryption. The IBM Security Key Lifecycle Manager for z/OS (SKLM) external key manager supports  TS7700 physical tape, but does not support TS7700 disk encryption. Release 5.0 includes support for TS7770T/TS7760T to attach to a TS3500 and TS4500 tape  library. R5.0 supports the 16 Gbps fibre switch that is used to communicate with the back-end  tape drives. The TS7700 16 Gbps fibre switch can be housed in a 3584-LXX or 3584-DXX  frame. The switches can be in a frame that contains some of the associated back-end drives,  or can be in a frame that does not contain any of the associated drives. The switches are  placed at the bottom of the tape library frame. The fibre patch panel must be removed from  the frame if it has one.  250  IBM TS7700 Release 5.0 Guide