Quantum scalar i40 User Manual page 226

Chapter 7: Encryption Key Management
Performing Scalar Key Manager Functions Available on the Library
200
• If automatic key generation succeeds, a RAS ticket informs you the
keys were generated and instructs you to back up both SKM server
keystores as soon as possible.
• If automatic key generation fails, the library tries again every time a
new key is requested, until the keys are 90 percent depleted. At that
point, the library stops trying to auto-generate keys and issues a
RAS ticket stating that you must manually generate keys. See
Manually Manually Generating Data Encryption Keys
and back up both SKM server keystores.
Generating Data Encryption Keys When 100% Depleted
If an SKM server completely runs out of data encryption keys for a
particular library, that library generates a diagnostic ticket, which states
that you have run out of data encryption keys and that the library
attempted to fail over to the other SKM server. If this happens, it is
imperative that you manually generate a new set of data encryption
keys on the depleted server immediately and then back up both SKM
server keystores. See
page 200.
Manually Generating Data Encryption Keys
To manually generate data encryption keys, you need to temporarily
disable Library Managed Encryption (LME) on a partition, and then
enable it again. Enabling LME on a partition triggers the library to check
both SKM servers to see if new data encryption keys are needed. If so, it
creates the keys.
Note: The key generation process takes 15 minutes to an hour,
depending on network performance and quantity of keys
already used. The library notifies you when the process
completes. During key generation and backup, the SKM server
will not be able to process any library requests for data
encryption keys. You should not run any library or host-initiated
operations on SKM partitions during key generation and
backup.
Manually Generating Data Encryption Keys
Quantum Scalar i40 and Scalar i80 User's Guide
on page 200
on