Encryption behavior when performing tape out from encrypted HPE StoreOnce Store

Hey ​@Nikos.Kyrm,

Trying to get confirmation on this but HPE has its own format for writing and encrypting data. We hand over our data and there is some blackbox magic that HPE uses to store and encrypt it. 

In that regard, I do not think we can read HPE data as encrypted and pass that directly to the tape, since it would not be in our format. I believe the HPE device would give us the unencrypted data stream and we’d have to re-encrypt that either through hardware or software methods.

Hello ​@Damian Andre and all,

I just received a super useful detailed analysis from Viniss, Commvault technical support:
 

------------------------------------------------------------------------------------------------------------------------

If StoreOnce native (hardware) encryption is enabled, data is encrypted at rest on StoreOnce.

https://documentation.commvault.com/11.40/commcell-console/best_practices_for_hpe_storeonce_catalyst_library.html

However, when data is copied out to tape (auxiliary copy), the encryption does not automatically persist end-to-end unless tape encryption is also enabled.

The data sent to tape is decrypted by StoreOnce and then written to tape according to the tape library’s encryption settings.
If tape hardware encryption is not enabled, the data on tape will be unencrypted even if it was encrypted on StoreOnce.
 

Best Practices: Tape Encryption
HPE MSL G3 Tape Library (with encryption stick):

To ensure data is encrypted on tape, enable hardware encryption on the tape library.
The encryption stick (hardware key management) must be enabled/configured for tape hardware encryption to function.
This is the recommended and supported method for tape encryption, as it provides strong security and compliance.
https://documentation.commvault.com/v11/commcell-console/hardware_encryption.html

https://documentation.commvault.com/v11/commcell-console/comparison_of_software_and_hardware_encryption.html

StoreOnce Software Encryption:

StoreOnce software encryption only protects data at rest on StoreOnce.
It does not provide end-to-end encryption for tape out unless tape hardware encryption is also enabled.
 

Commvault Software Encryption:

If you require end-to-end encryption and cannot use tape hardware encryption, you may enable Commvault software encryption for the auxiliary copy to tape.
However, best practice is to use hardware encryption on tape for performance and compliance.

------------------------------------------------------------------------------------------------------------------------

Hope this helps!

Best regards,
Nikos

Great to hear ​@Nikos.Kyrm and thanks for sharing the update back here too!