Tape encryption with HP Data Protector and StorageWorks MSL 6000

you are better off using software encryption anyhow - the hardware crypto in the LTO drives isn't very good, but its at least better than the hardware  compression ;)

While HP Data Protector does support encryption (and at a high grade - AES@256) its a separately licenced feature - see your vendor for details of the module, you might need a 6.1 upgrade to use it :(

HP's MSL should already have hardware encryption support, what money can buy is really not a problem. But current trend of persistence data security suggests it should start right at the source which is the operational data (e.g. database files, SAN, file servers, etc) rather than at backup stage. If your operational data are already encrypted on disk, backup on the encrypted disk gives you secure backup right at once. Reason why HP launches FC SAN encryption switch but it's not cheap. Take a look as well at other alternatives such as Bloombase or Decru.

Some good info above, and some bad info above.  Below are all facts.

1) HW encryption was introduced in LTO-4 tape drives.  It uses AES-256, which is considered to be unbreakable.  There is some chance that if a key is used on multiple tapes AND a bad guy gets access to more than one tape AND the bad guy has access to tremendous computing resources AND the bad guy has great knowledge of encryption, he *might* be able to decrypt the tapes.  But it would take a concerted effort, and all of the above -- regardless, it's an argument that, if you're concerned about someone targeting your tapes, you should rotate or change your encryption keys periodically.  For most people, that the tape is encrypted at all is enough for the bad guys to move on to easier targets.  HW Encryption has the benefit of no server CPU or memory overhead, and no loss of compression (since the data is compressed before it is encrypted).

2) The MSL 6000 libraries do support LTO-4 tape drives.  The MSL 6000 libraries do not themselves have any kind of tie-in to the encryption technology in the LTO-4 drives.  If the backup application supports encryption, then you can encrypt the data using LTO-4 HW encryption regardless of which library the drive is in.

2a) The MSL G3 (MSL2024, MSL4048, MSL98096) libraries not only support LTO-4 but also support the MSL Encryption Kit, a pair of USB dongles that plug in to an MSL G3 library and generate and securely store up to 100 encryption keys.  These encryption keys are sent to the LTO-4 tape drive and all backups sent to a drive in a partition designated as "encrypting" will be encrypted.  The Encryption Kit also integrates with the library GUI, so that you must know both the library password, and the Encryption Kit password, to be able to enable or disable encryption.  This is NOT a solution that will work with the MSL 6000.

3) Data Protector 6.0 and later, and most current business backup applications, can use a pass phrase to generate an encryption key, and will send that key and instructions to encrypt a backup job to an LTO-4 tape drive, using the drive's HW encryption.  This solution has the benefit of no server overhead, no loss of data compression; tapes can be read on another manufacturer's drive (IBM, Quantum), as long as it's in the same Data Protector cell, or you can get the key to the new cell manager.  Negatives include: since the key is generated by a passphrase, it will likely not be truly random, and thus will be more easily cracked; and, just as you can enable encryption by checking a box in the backup job properties, someone could uncheck that box, run a backup, re-check that box... and now you've got one person who knows that *this* tape is not encrypted; and, key management can be an issue if you change keys frequently.

4) Most (if not all) business backup applications can encrypt data before sending it to the tape drive (SW encryption), using a passphrase-generated key.  Advantages: Works with any tape drive (Any LTO, DAT, AIT, ...).  Disadvantages: lack of randomness in passphrase-generated keys; ease of turning off encryption on a job; SW encryption is VERY processor-intensive -- I have seen it cut backup performance by as much as 50%; Encrypted data is no longer compressible, so you lose any benefit of compression on the tape HW; and, key management can be an issue if you change keys frequently.

Here, then are your options:
a) If you have LTO-4 drives in your MSL 6000, purchase the encryption license for Data Protector.  I recommend you also update to 6.1, as the integration with encryption is better.

b) If you don't have LTO-4 drives, either:
b1) Purchase and use the software encryption facility of Data Protector (again, I recommend you upgrade to 6.1).  BE SURE you read the documentation and generate the first encryption key, or otherwise, the 'encryption' will be an XOR, not AES-256.
or b2) Purchas an MSL2024 or MSL4048 library with one or more LTO-4 drives, and optionally the MSL Encryption Kit (purchasing the Encryption Kit means that encryption is strongest and not controlled by the backup application, but through the MSL GUI, and, the Encryption Kit will help with key management in environments where a key is changed up to once a week).