content_image/970957.jpg
These methods differ in the following ways: 

GLYPH<SM590000> Where the encryption policy engine resides 

GLYPH<SM590000> Where key management occurs for your encryption solution 

GLYPH<SM590000> How the key manager is connected to the drive 

Your operating environment determines the best method for you. 

Key management and the encryption policy engine can be in any of the environment layers that are shown in Figure 3-1. 

<img src='content_image/970957.jpg'>

The application layer, for example, IBM Spectrum Protect, initiates the data transfer for tape storage. 

The library layer is the TS4500 tape library, which contains an internal interface to each tape drive that is installed in the library. 

## 3.2.3 Application-managed encryption (AME) 

The application-managed tape encryption method is best in operating environments that run an application that already can generate and manage encryption policies and keys, such as IBM Spectrum Protect. Policies that specify when encryption is to be used are defined through the application interface. The policies and keys pass through the data path between the application layer and the encryption-capable tape drives. 

