Search <book_title>...

Veritas NetBackup™ Cloud Administrator's Guide

Last Published: 2021-06-07

Product(s): NetBackup (9.1)

About NetBackup KMS for encryption of NetBackup cloud storage

NetBackup uses NetBackup Key Management Service (NetBackup KMS) to manage the keys for the data encryption for disk storage. NetBackup KMS is a NetBackup master server-based symmetric key management service. The service runs on the NetBackup master server. An additional license is not required to use the NetBackup KMS functionality. NetBackup uses NetBackup KMS to manage the encryption keys for cloud storage.

See About data encryption for cloud storage.

You need to provide KMS and key-specific information when you enable the Encryption through Cloud Storage Server Configuration Wizard and configure disk pool using the Disk Pool Configuration Wizard. Key-specific information is based on the KMS server configuration. If a KMS server is not configured, NetBackup KMS is by default configured as a KMS server as part of the encryption setting for the cloud storage server.

The following table describes the keys that are required for the NetBackup KMS database. You can enter the pass phrases for these keys when you use the Cloud Storage Server Configuration Wizard.

Table: Encryption keys required for the KMS database

Key	Description
Host Master Key	The Host Master Key protects the key database. The Host Master Key requires a pass phrase and an ID. NetBackup KMS uses the pass phrase to generate the key.
Key Protection Key	A Key Protection Key protects individual records in the key database. The Key Protection Key requires a pass phrase and an ID. NetBackup KMS uses the pass phrase to generate the key.

The following table describes the encryption keys that are required for each storage server and volume combination. If you specify encryption when you configured the cloud storage server, you must configure a pass phrases for the key group for the storage volumes. You enter the pass phrase for these keys when you use the Disk Pool Configuration Wizard.

Table: Encryption keys and key records for each storage server and volume combination

Item	Description
Key group key	A key group key protects the key group. Each storage server and volume combination requires a key group, and each key group key requires a pass phrase. The key group name must use the format for the storage type that is described as follows: For cloud storage, the following is the format: **storage_server_name:volume_name The following items describe the requirements for the key group name components for cloud storage: storage_server_name** : You must use the same name that you use for the storage server. The name can be a fully-qualified domain name or a short name, but it must be the same as the storage server. The colon (:) is required after the storage_server_name. *volume_name* : You must specify the LSU name that the storage vendor exposes to NetBackup. The Disk Pool Configuration Wizard conforms to this format when it creates a key group.
Key record	Each key group that you create requires a key record. A key record stores the actual key that protects the data for the storage server and volume. A name for the key record is optional. If you use a key name, you can use any name. It is recommended that you use the same name as the volume name. The Disk Pool Configuration Wizard does not prompt for a key record key; it uses the volume name as the key name.

Item

Description

Key group key

A key group key protects the key group. Each storage server and volume combination requires a key group, and each key group key requires a pass phrase. The key group name must use the format for the storage type that is described as follows:

For cloud storage, the following is the format:

storage_server_name:volume_name

The following items describe the requirements for the key group name components for cloud storage:

storage_server_name : You must use the same name that you use for the storage server. The name can be a fully-qualified domain name or a short name, but it must be the same as the storage server.
The colon (:) is required after the storage_server_name.
volume_name : You must specify the LSU name that the storage vendor exposes to NetBackup.

The Disk Pool Configuration Wizard conforms to this format when it creates a key group.

Key record

Each key group that you create requires a key record. A key record stores the actual key that protects the data for the storage server and volume.

A name for the key record is optional. If you use a key name, you can use any name. It is recommended that you use the same name as the volume name. The Disk Pool Configuration Wizard does not prompt for a key record key; it uses the volume name as the key name.

More information about NetBackup KMS and external KMS is available in the NetBackup Security and Encryption Guide.