About external KMS

The external KMS support offers an alternative to the NetBackup key management service (KMS) for data-at-rest encryption keys.

See About the Key Management Service (KMS).

Backup images that are stored on storage configurations like tape, cloud, Cloud Catalyst, MSDP, and AdvancedDisk can be encrypted using the keys that the external KMS server maintains.

NetBackup supports the communication with external KMS using Key Management Interoperability Protocol (KMIP).

See the NetBackup Compatibility List for the KMIP versions that NetBackup supports.

NetBackup supports all KMS servers that use any of the NetBackup-supported KMIP versions.

NetBackup supports the authentication with external KMS server using security certificates. During each operation, NetBackup presents the certificate to the external KMS and requests to perform the required operation. External KMS validates the certificate and performs that operation if the user has the required permissions.