System Programmer Reference › Backing Up Data › Using Encryption for Data Security

Using Encryption for Data Security

CA VM:Backup supports data encryption and decryption for backup and restores. CA VM:Backup supports several encryption algorithms and keys which use the National Institute of Standards and Technology's Standards as defined in the Federal Information Processing Standards Publications (FIPS PUBS). These are Advanced Encryption Standard (AES), Triple Data Encryption Algorithm (TDEA or DES3), and Data Encryption Standard (DES). Because of federal regulations, some international customers receive another encryption/decryption algorithm, RC2.

When encryption is used, all data pertaining to the contents of the minidisks or file spaces specified in the exception file for the backup job is encrypted on tape. This includes the following:

• Contents of all files, tracks, and blocks
• Information about directories, aliases, and authorizations specified to be encrypted and backed up in the job
• Any restrictions indicated in the associated exception file

Data encryption requires a large amount of CPU time; you may want to use it for highly sensitive information only. If you are running on a processor that supports CP Assist for Cryptographic Function (CPACF), your encryption and decryption processing will be accelerated. Hardware encryption and decryption is faster executing the security algorithm than software encryption and decryption because the processing is performed on a specialized processor dedicated to that function, eliminating the CPU cycles needed to execute the software algorithms on your processor’s standard CPUs.

CA VM:Backup displays which of its encryption algorithms have hardware assist by using the QUERY ENCRYPT ALL command. Depending on the nature of the data being backed up, you may be able to speed up processing by packing data whenever you use encryption. Data packing results in less data to encrypt.