Selecting Tape Files for Encryption Using DFSMS › How Header Labels Work to Manage Tapes

How Header Labels Work to Manage Tapes

CA Tape Encryption modifies standard tape labels and adds User Header Labels (UHLs) and User Trailer Labels (UTLs) to embed identifying information on the tapes that it encrypts, and to include information about how the tape was encrypted. It uses this information when monitoring tape read processing to identify encrypted tapes. The user labels are hidden from the application program. The tape labels appear to be standard labels (SL) for all intents and purposes.

This method of storing data about the encrypted tape file in the labels of the tape itself allows CA Tape Encryption to determine the following:

• Whether the tape has been encrypted
• The type of encryption used
• The key label name used for encryption

Depending on the type of tape you are encrypting, the information written to the labels for in-house and B2B tapes differs.

After the user header labels are written, the application can begin to write data to the tape. CA Tape Encryption intercepts and encrypts the data before placing it on tape.

Note: When writing to an encryption-enabled TS1120 using the EEFMT2 recording technique, CA Tape Encryption does not perform the encryption and therefore the tape labels are not altered by CA Tape Encryption (r12.6 and above). If the CA Encryption Key Manager is being used to manage the digital certificates for the TS1120, it does so by dynamically altering the data class information as seen by the IBM TS1120 EKM application but it does not otherwise alter the normal TS1120 encryption/decryption processes and therefore does not require any changes to the tape header or trailer labels.