Please help with backupsets encryption using EKM

[reddy]

Hi All,

Can anyone post which method is the best for Backupset encryption among LME(library talks to EKM host for the key) and SME (in which atape devdrvr talks to EKM host for the key)..... and why?

We are planning to implement encryption for backupsets but not sure where/how to start on sending keys to DR.
To dr site, is it ok to send EKM host backup for recvering encrypted data or we need to send anything else with backupsets?

Any help is appreciated.

[reddy]

TSM gurus and senior members....please help me.

Thanks in advance!

[julien.sauvanet]

Hi reddy,

i'm actually working on same case.
After many investigation we choose the AME method for encryption. in that mode backupset, dbbackup and export are not encrypted ...
about your question, i think the best way is to use IBM EKM or TKLM ( Tivoli ).
For your recovery, just send EKM server data, configure your DR Library pointing to your backup EKM, insert backupset and restore it!
using LME and EKM, the only thing you need is that your library reach the EKM to deal the key for the backupset label.