About NetBackup KMS for encryption of NetBackup cloud storage
NetBackup uses NetBackup Key Management Service (NetBackup KMS) to manage the keys for the data encryption for disk storage. NetBackup KMS is a NetBackup master server-based symmetric key management service. The service runs on the NetBackup master server. An additional license is not required to use the NetBackup KMS functionality. NetBackup uses NetBackup KMS to manage the encryption keys for cloud storage.
See About data encryption for cloud storage.
You need to provide KMS and key-specific information when you enable the Encryption through Cloud Storage Server Configuration Wizard and configure disk pool using the Disk Pool Configuration Wizard. Key-specific information is based on the KMS server configuration. If a KMS server is not configured, NetBackup KMS is by default configured as a KMS server as part of the encryption setting for the cloud storage server.
The following table describes the keys that are required for the NetBackup KMS database. You can enter the pass phrases for these keys when you use the Cloud Storage Server Configuration Wizard.
Table: Encryption keys required for the KMS database
| Key | Description |
|---|---|
|
Host Master Key |
The Host Master Key protects the key database. The Host Master Key requires a pass phrase and an ID. NetBackup KMS uses the pass phrase to generate the key. |
|
Key Protection Key |
A Key Protection Key protects individual records in the key database. The Key Protection Key requires a pass phrase and an ID. NetBackup KMS uses the pass phrase to generate the key. |
The following table describes the encryption keys that are required for each storage server and volume combination. If you specify encryption when you configured the cloud storage server, you must configure a pass phrases for the key group for the storage volumes. You enter the pass phrase for these keys when you use the Disk Pool Configuration Wizard.
Table: Encryption keys and key records for each storage server and volume combination
| Item | Description |
|---|---|
|
Key group key |
A key group key protects the key group. Each storage server and volume combination requires a key group, and each key group key requires a pass phrase. The key group name must use the format for the storage type that is described as follows: For cloud storage, the following is the format: storage_server_name:volume_name The following items describe the requirements for the key group name components for cloud storage:
The Disk Pool Configuration Wizard conforms to this format when it creates a key group. |
|
Key record |
Each key group that you create requires a key record. A key record stores the actual key that protects the data for the storage server and volume. A name for the key record is optional. If you use a key name, you can use any name. It is recommended that you use the same name as the volume name. The Disk Pool Configuration Wizard does not prompt for a key record key; it uses the volume name as the key name. |
More information about NetBackup KMS and external KMS is available in the NetBackup Security and Encryption Guide.