8464ch02_Architecture.fm Draft Document for Review February 7, 2020 3:15 pm the encryption configuration through the MI, you provide IP addresses for a primary and  an optional secondary key manager. The TS7700T encryption supports the use of a default key. This support simplifies the  management of the encryption infrastructure because no future changes are required at  the TS7700T. After a pool is defined to use the default key, the management of encryption  parameters is performed at the key manager: GLYPH<SM590000> Default EKs – Creation and management of encryption certificates – Device authorization for key manager services – Global default key definitions – Drive-level default key definitions – Default key changes as required by security policies All logical volumes that are directed to a pool that is enabled for encryption are encrypted  when they are premigrated to the physical stacked volumes or reclaimed to the stacked  volume during the reclamation process. The SG construct name is bound to a logical volume  when it was last mounted.  Through the MI, the SG name is associated with a specific pool number. When the data for a  logical volume is copied from the TVC to a physical volume in an encryption-enabled pool, the  TS7700T determines whether a new physical volume must be mounted.  If a new cartridge is required, the TS7700T directs the drive to use encryption during the  mount process. The TS7700T also provides the drive with the key labels specified for that  pool. When the first write command is received by the drive, a connection is made to a key  manager through the TS7700T and the key that is needed to perform the encryption is  obtained. Once the first write occurs, the same physical tape requires its drive to  communicate with the key server for every mount.  Any partially filled physical volumes continue to use the encryption settings that are in effect  at the time that the tape was initially written from BOT. The encryption settings are static until  the volumes are reclaimed and rewritten again from BOT. Figure 2-6 on page 57 shows that the method for communicating with a key manager is  through the same Ethernet interface that is used to connect the TS7700T to your network for  access to the MI.  56  IBM TS7700 Release 5.0 Guide