disk encryption. If you use only internal or local key management for TS7700 TVC disk encryption, the z/OS version of SKLM can be used for TS7700T physical tape encryption. 

After encryption is enabled, any future FC4017 Manufacturing Cleanup process that is run against the TS7700 provides the SSR an option to run a cryptographic erase. As part of the cleanup process, all data encryption keys are destroyed if this cryptographic erase option is enabled. A repurpose of the TS7700 at that point requires a complete file system rebuild. 

## TS7760 TVC Encryption 

All TS7760 configurations contain self-encrypting disk drives or DDMs. Encryption can be internally or externally key managed. Encryption can be enabled retroactively and concurrently for any TS7760 in the field. Any TS7760 with internal key management enabled also can be concurrently upgrade to external key management. 

Internal key management manages lock keys for each CSA disk string within the CSA controllers and the TS7760 server. These internally managed keys can be rotated through the MI or through an SSR-initiated process. These keys can also be optionally exported to DVD. 

External key management is supported by using the IBM SKLM (formerly IBM Tivoli Key Lifecycle Manager). Up to two IBM SKLM servers are supported per TS7700. The TS7760 uses an IBM proprietary protocol for communications between the TS7760 and the IBM SKLM server, which is optionally protected by using TLS 1.2. 

When external key management is enabled, the lock keys that are used for each CSA disk string are managed entirely outside of the TS7760. No alternative method is available to unlock the CSA encryption keys without an exchange with an IBM SKLM server. The externally managed keys can be rotated through the MI or an SSR-initiated process. 

## TS7770 TVC Encryption 

All TS7770 configurations support encryption for data at rest. The TS7700 does not rely on self-encrypting disk drives or DDMs. Encryption instead occurs within the CSB disk cache controller by using hardware acceleration. Because of this approach differs from the TS7760 approach, encryption support on the TS7770 must be enabled or disabled at manufacturing time. 

No method exists to enable encryption retroactively on a TS7770 after it is installed in the field. When enabled at manufacturing time, local key management is initially enabled. External key management can then be enabled after it is installed in your lab or later concurrently. 

Local key management manages lock keys for each CSB disk string within USB flash drives that are connected to each redundant CSB subcontroller. Two backup USB flash drives also exist. That is, a total of four USB flash drives are used per CSB disk string (two USB flash drives plugged in and two for backup). 

The lock key that is stored within the USB sticks is used to unlock the main encryption key, which is scattered among the DDMs of the string. Subsets of the DDMs contain only a random piece of the locked encryption key, which makes it non-valuable without the remaining DDMs. The portability of the USB flash drives allow for their removal if the TS7770 is at risk. For example, if your data center is being evacuated because of approaching weather, the TS7700s and CSB controllers can be powered down and their USB sticks removed. 

External key management is supported by using the IBM SKLM. Up to two IBM SKLM servers are supported per TS7770. The TS7770 uses the KMIP protocol for communications between the TS7770 and the IBM SKLM server, which is protected by using TLS 1.2. 

