VBR v7 - Backup to Tape Encryption

[brupnick]

I know that this feature was just announced this morning and because v7 isn't out yet, I'm somewhat expecting the "we're not allowed to say just yet" answer, but I'm going to ask anyway.

Based on the video that was posted, it looks like hardware compression will be supported by this new feature, but unless I missed it, I didn't see anything relating to encryption. Will the files that are written to tape have the option to be encrypted? Unless feature announcement 6 or 7 is the introduction of encrypting the native VBR files (which would be awesome, BTW), I'll have unencrypted files being written to unencrypted tapes. If you're like me and store your tapes at an offsite location (and you're not responsible for transporting them there), I'm sad to say that I won't be able to use this feature until there's a mechanism to encrypt the native files or tapes.

Personally, I'd love to see the ability to encrypt my VBR files, so if that's not one of the remaining two feature announcements, please consider this a +1 for that feature request.

As always, thanks for listening!

[tsightler]

It will support hardware based tape encryption only in the case that the encryption is transparent to the application, i.e. system managed or library managed hardware based encryption will work fine.

[oswanson]

We recently decided to use MS bitlocker to our backups drives that go offsite. Tip: Make sure that you store the encryption keys somewhere else on your network, plus somewhere else outside of your network (in case of a real disaster). Also drives will encrypt much faster if they have been freshly fomatted.

[phil.p]

Hi, I'm looking forward to testing the tape functionality in v7 but would like to know if there will be support for on the fly encryption for these backups?

As tapes often go offsite, having the media encrypted is simply good practice but unlike backup to disk, we can't create pre-encrypted volumes on tapes to store the backups on. We currently use the inbuilt encryption options in BackupExec and it would be nice if we could switch to 100% Veeam backups instead but without encryption this isn't going to be possible.

Thanks,
Phil

[foggy]

Phil, please see Tom's answer above. Veeam B&R v7 will not provide built-in encryption, however you will have the ability to use hardware-based encryption while offloading backup files to tapes with it. Hope this helps.

[peterssachs]

Unfortunately, our LTO-5 library does not implement Hardware Encryption management though the library itself. I know the higher end units have this feature but I inherited this equipment. Saying that Veeam allows tape encryption if completely implemented on the library level is like saying NTBackup in Windows NT 2000 supports Tape Encryption.

In all honesty in 2013 all tapes should be encrypted in any serious Enterprise. If Veeam 7.0 does nothing to address this I may need to buy Arcserve, BackupExec and similar products invented in the last century.

If anyone knows of a software product that can control the encryption of a LTO-4/5 Library in the background I would love to know. There is no backup at my new company and staring out %100 Veeam would be awesome! I am using two Tandberg LTO-5 1U Storageloaders.

[strupp3003]

Hello everyone,

we'd also need some type of encryption for our tapes. Reading that Veeam 7 would be capable of using the hardware encryption offered by the drive, i purchased a HP StoreEver Ultrium 6250 LTO-6 SAS drive that is directly (HBA) connected to our Backup-Server running Veeam 7.0 R2. The drive offers hardware Encyption, but i'm not able to find any way to activate it. From the HP Support i only got the Information that i need some kind of Key management System that is integrated in some backup Software (i.e. HP Data Protector). Is there any way of getting some additional Key Management Software to handle the encryption, while using Veeam for the Backups? (Backup to tape itself works fine...)

Any Help / Advice would be highly appreciated!! Thanks

Stephan

[tsightler]

Indeed, the hardware does the encryption, however, something has to manage that encryption. Veeam currently does not have native support for managing the hardware based encryption options which is why my note above specifically mentions that you need either a library or system managed option, i.e. something outside of Veeam itself, to manage the encryption. It sounds like you have a standalone drive which means that library managed encryption isn't going to be an option, so you're down to some type of software that runs on the OS to manage the encryption. Unfortunately, I have no idea if HP offers such software for standalone drives.

[ephracis]

Hi,

My company has just moved to Veeam for its backup solution and we would like our tapes to be encrypted. As I understand it, Veeam does not support encryption in the software, it only supports hardware based encryption (done by the tape drive itself). We use a Dell PowerVault 124T which supports hardware encryption. So I should be good to go, right?

But I can't find where in Veeam I enable hardware encryption on the tape drive. How do I start encrypting the tapes?

[Dima P.]

Hello Christoffer,

The hardware encryption (managed by your tape library/standalone driver) should be enabled somewhere in your device management console. You may require additional software installed (for managing encryption keys); I guess this info could be found in the device user guide.

From Veeam B&R, in most of the cases, it should work with no issues, as encryption/decryption would take place on hardware side.
Thank you.

[tsightler]

Exactly, something has to provide the encryption keys, this is the part that Veeam does not currently do. When using library managed encryption there are typically two options, some devices provide a simple USB "dongle" which contains the key and is used to encrypt all tapes. Other libraries use KMS software that is installed on a server in the environment (or in some cases a purpose build appliance) which manages the encryption keys independent of the application.

While I know that newer Dell libraries such as the TL and ML series have at least one of these options available, I'm not sure about the PV124T.

[motoxrdr21]

Is there any update on the availability of encryption key management within Veeam? Is it somewhere on a feature road map with an estimated release time frame? We'll be purchasing a new LTO6 library next year and I need to figure out whether I'm budgeting twice as much on the library plus the additional licensing to get library-managed encryption or if I can use application-managed when it's available in Veeam.

Hardware tape encryption aside I'm amazed we don't have the option to at the very least enable software encryption of vbk files.

[veremin]

With v8 it will be possible to encrypt backup files offloaded to tape mediums by both tape jobs: be it backup to tape or files to tape one. Thanks.

[motoxrdr21]

With v8 it will be possible to encrypt backup files offloaded to tape mediums by both tape jobs: be it backup to tape or files to tape one. Thanks.

Thanks v.Eremin! Any estimated time frame for a v8 release?

[veremin]

Check the latest community digest:

v8 release which is planned for early Q4