About MSDP Encryption using NetBackup Key Management Server service
NetBackup incorporates the Key Management Server (KMS) with Media Server Deduplication Pool.
MSDP encryption carries out segment-level encryption and assigns a unique encryption key for every data segment. Then the unique encryption key is encrypted by KMS service.
User manages KMS service to create and activate a key. In KMS service, one active key must exist.
You can configure the KMS service from the NetBackup web UI or the NetBackup command line during storage server configuration.
Note:
You cannot disable the MSDP KMS service after you enable it.
If the KMS service is not available for MSDP or the key in the KMS service that MSDP uses is not available, then MSDP waits in an infinite loop and the backup job may fail. When MSDP goes in an infinite loop, some commands that you run might not respond.
After you configure KMS encryption or once the MSDP processes restart, check the KMS encryption status after the first backup finishes.
The keys in the key dictionary must not be deleted, deprecated, or terminated. All keys that are associated with the MSDP disk pool must be in an active or an inactive state.
You can use the following commands to get the status of the KMS mode:
For UNIX:
/usr/openv/pdde/pdcr/bin/crcontrol --getmode
For MSDP cloud, run the following keydictutil command to check if the Logical Storage Unit (LSU) is in KMS mode:
/usr/openv/pdde/pdcr/bin/keydictutil --list
For Windows:
<install_path>\Veritas\pdde\crcontrol.exe --getmode
Note:
If you use the nbdevconfig command to add a new encrypted cloud LSU and an encrypted LSU exists in this MSDP, the keygroupname must be the same as the keygroupname in the previous encrypted LSU.
For enabling KMS, refer to the following topics: