Regularly scheduled encryption key backups

An encryption key can be automatically backed up at scheduled intervals (for example, daily or weekly) at a specified time to the key management server. This operation is called a regular backup. You can specify the schedule for the regular backup in the Edit Encryption Environmental Settings window. Regular backups are performed automatically even when the user is not logged in.

Requirements for scheduling regular backups

  • You must have a valid, enabled license key to perform regular backups. If the Encryption License Key expires or the license is deleted, scheduled backups will not be performed.

  • Create a user dedicated to the regular backup (referred to here and in the user interface as the regular backup user), and then enter the user name and the password of the regular backup user in the Edit Encryption Environmental Settings window when configuring the key management server to include regular backups.

    For details about how to create a new user, see the Virtual Storage Platform G1000 System Administrator Guide for your storage system.

Caution

A regular backup might fail if you edit or remove the regular backup user account, including when you delete users, change the regular backup user password, or change roles. For this reason, every time you edit a regular backup user account, be sure to respecify the regular backup user's user name and password in the Edit Encryption Environmental Settings window.

How regular backups are queued

At the specified time for a regular backup, the backup is queued as a task. You can verify queued tasks in the Task window. If other tasks are already queued, the regular backup will not start until the other tasks are complete. Because of this, the time that the regular backup begins might be different from the time you specified.

Note Like any other task, you can verify the regular backup task result in the Task window and in the audit log. You should verify, on a regular basis, that backups are being created. The audit log is output using the regular backup user name.

At the specified time for a regular backup, if a previous backup is not performed because another queued task is still in progress, the second backup is not queued. Only the first backup is performed. For example, if you specify 00:00 and 02:00 for regular backups, and a task started before 00:00 completes at 03:00, the 02:00 regular backup is not queued, and only the regular backup for 00:00 is performed at 03:00.

To discontinue regular backups, clear the check box for Enable Encryption Key Regular Backup to Key Management Server in the Edit Encryption Environmental Settings window.

A regular backup deletes old encryption keys. Because of this, the number of encryption keys to be backed up regularly is always one. Manually backed up keys are not deleted. In the same way as manually backed up keys, the status of a regular backup encryption key can be viewed, and the key itself can be restored or deleted.

When the SVP stops, regular backups are not performed. After the SVP is restarted, regularly scheduled backups will resume queueing as a task.

CautionDuring a regular backup, your service representative cannot perform maintenance of storage systems and SVP operations. If a regularly scheduled backup time comes during maintenance, cancel the backup task temporarily or revise the regular backup settings.
Important Performing a regular backup is a supplemental function. In addition to regular backups, manual backups must be performed, especially, after you complete any of the following tasks:
  • Create encryption keys
  • Add, remove, or replace drives
  • Add, remove, or replace EBEDs
  • Replace controllers
  • Update CEKs
  • Update KEKs
Parent Topic