About MSDP Encryption using KMS service
NetBackup incorporates Key Management Server (KMS) with Media Server Deduplication Pool.
MSDP encryption carries out segment-level encryption and assigns a unique encryption key for every data segment. A customer key is retrieved from NetBackup KMS to encrypt the segment key. The customer key is refreshed regularly and KMS service rotates the user key frequently (every 3 months by default).
You can configure the KMS service from the NetBackup Administration Console or the NetBackup command line during storage server configuration.
Note:
You cannot disable the MSDP KMS service once you enable it.
You can use the following commands to get the status of the KMS mode:
For UNIX:
/usr/openv/pdde/pdcr/bin/crcontrol --getmode
For Windows:
<install_path>\Veritas\pdde\crcontrol.exe --getmode
For enabling KMS, refer to the following topics: