Product Announcement August 29, 2006

IBM System Storage TS1120 Tape Drive Model E05 supports encryption
Overview
The IBM System Storage TS1120 Tape Drive (machine type 3592, Model E05) has been enhanced to provide you the option of using drive based data encryption. This encryption capability is now standard on all new TS1120 Tape Drives and is a chargeable upgrade feature for existing installed TS1120 Tape Drives. The encryption capability includes drive hardware, as well as microcode additions and changes. Also being introduced is a new, separate IBM Encryption Key Manager component for the Java Platform (Encryption Key Manager) program that supports the generation and communication of encryption keys for the tape drives across the enterprise. This TS1120 Tape Drive encryption announcement supports the previous storage statements of direction, dated April 27, 2006. The TS1120-based encryption and associated Encryption Key Manager component are supported in a wide variety of operating system environments including z/OS , i5/OS , AIX , HP, Sun, Linux , and Windows . In addition, three different encryption management methods are supported: Application, System, or Library Managed. This encryption capability is supported when the TS1120 Tape Drive is integrated or attaches in the IBM System Storage TS3500 Tape Library, IBM System Storage TS1120 Tape Controller Model C06, IBM TotalStorage 3592 Tape Controller Model J70, IBM TotalStorage 3494 Tape Libraries, IBM TotalStorage C20 Silo Attach frame, and stand-alone environments. The TS1120 drive s encryption capability and its subsystem integration support help provide you with a flexible tape data encryption solution that supports encryption and key management across a variety of environments, supporting a single point of control for all encryption keys, and most importantly, can help customers protect tape data in a cost effective way.

At a glance
IBM System Storage TS1120 Tape Drive encryption capability enhancements include: Drive hardware and microcode additions, and changes for TS1120 Tape Drive encryption A no charge encryption-capable feature number for new TS1120 Tape Drives An optional chargeable encryption feature number upgrade, that may contain refurbished parts, for installed TS1120 Tape Drives Encryption capabilities designed to work with the new Encryption Key Manager component Three encryption management techniques supported: System, Application and Library Managed TS1120 Tape Drive encryption supported for IBM System Storage tape subsystems and libraries A router for out-of-band key management support and Encryption Key Manager connectivity for Tape Controllers, Tape Frames, and Tape Subsystem

Key prerequisites
The TS1120 Tape Drive is supported in a wide range of environments: IBM System z , System i , System p , System x , and can be used with a wide range of Linux on System z, Sun, and Hewlett Packard servers, and Linux-based servers, as well as Intel -compatible servers running Linux, Microsoft Windows 2000, or Windows Server 2003. A tape controller is required for attachment to ESCON or FICON channels on IBM mainframe servers. Refer to the Technical information section for details.
Planned availability dates

September 8, 2006: Open systems TS3500 Library, Application, and System Managed encryption. September 8, 2006: TS1120 Tape Drive Model E05 using System Managed Encryption with supported AIX servers. September 8, 2006: Encryption Key Manager on AIX, z/OS, i5/OS, and Linux. September 29, 2006: Application Managed Encryption support using Tivoli Storage Manager. October 27, 2006: z/OS System Managed Encryption. This includes support on the TS1120 Tape Controller Model C06 (3592 C06), 3494 Models L10, L12, L14, L22 Tape Library Frames, 3592 Model J70, 3590 Model C10, 3952 Model F05, 3953 Model F05 and TS3500 Tape Library (3584 L23, D23, L22, D22). December 1, 2006: Encryption Key Manager on HP, Sun, and Windows

This announcement is provided for your information only. For additional information, contact your IBM representative.
IBM Europe, Middle East, Africa IBM is a registered trademark of International Business Machines Corporation.

ZG06-0697

Description
The TS1120 Tape Drive is a successor to the 3592 Tape Drive Model J1A and the 3590 Enterprise Tape Drive. The TS1120 Tape Drive is machine type 3592 and Model E05. It is designed for high-performance tape applications, including: High-speed data-save operations where backup windows are critical, and large amounts of data are archived to tape. Protection of tape data by high speed encryption for security or regulatory needs. Large-scale automated tape environments performance and reliability are required. where

process, and will generate and provide keys to the TS1120 tape drive. Tivoli Storage Manager is being enhanced to support this capability.
Library Managed: Encryption by volume and drive policy will be supported. The user will set up and control the encryption through the library interface. Initially, this will be supported for the TS3500 or 3584 tape library in open systems environments. The Encryption Key Manager program will be required for this support. System Managed: With Systems Managed Encryption, the encryption policy will be passed between the server and the drives. This is the only vehicle for z/OS environments and will require the Encryption Key Manager program. DFSMS will support the Encryption Key Manager component. Systems managed encryption will also be available for AIX servers. This support will require a new AIX tape device driver, as well as the Encryption Key Manager program.

Large-scale mass data archive applications where massive amounts of data need to be quickly saved to tape for storage and later recall (examples include the seismic industry, data warehousing, and record management applications).

The TS1120 Tape Drive is the second generation of a new family of tape products that are designed to help address the growing needs of both new and existing IBM tape customers across a wide range of environments. The TS1120 Tape Drive now includes: Larger capacity compared to the 3592 Model J1A, to help you reduce the number of cartridges required and floor space needed Smaller form factor compared to the 3590 Tape Drive, which can help reduce the automation foot print Dual-ported native switched fabric interface, designed to enhance the attachment flexibility High reliability, to help improve operations Additional performance and access improvements over the 3592 J1A Hardware tape encryption to protect tape data integration with the new Encryption Key Manager component

System Managed Encryption on open systems is in-band where tape drive requests to the Encryption Key Manager component travel over the Fibre Channel channels to the server hosting the EKM. Systems Managed Encryption on z/OS has two different configuration options. First is in-band, where tape drive requests to the Encryption Key Manager component travel over the ESCON/FICON channels to the server proxy that is TCP/IP connected to the Encryption Key Manager. Second is out-of-band, where the tape controller establishes the communication to the Encryption Key Manager server over TCP/IP connections between the tape controller and the Encryption Key Manager server. A router is required for out-of-band and Encryption Key Management support and Encryption Key Manager connectivity for the TS1120 Tape Controller Model C06, the 3592 J70 Tape Controller, the 3952 F05 and 3953 F05 Tape Frames, the 3494 L10, L12, L14, L22 Tape Library Frame, and IBM TotalStorage 3590 C10 Subsystem.

Product positioning
The TS1120 Tape Drive is the successor to the 3592 Tape Drive Model J1A and the highly successful 3590 Enterprise Tape Drive. The TS1120 Tape Drive is supported in a wide range of environments including selected System z, iSeries , AS/400 , pSeries , RS/6000 , xSeries , Sun, and Hewlett Packard servers, as well as Intel-compatible servers running Linux and Microsoft Windows 2000, or Windows Server 2003. It has significant potential performance and capacity benefits over the IBM 3590, as well as other half-inch tape drives such as the IBM 3480, 3490, or 3490E, and now supports data encryption on a tape cartridge for security and the customers regulatory needs.

Encryption

The TS1120 Tape Drive is being enhanced to support encryption of data on a tape cartridge. New T1120 Tape Drives will be encryption capable and a chargeable upgrade will be available for currently installed TS1120 Tape Drives. The encryption capability is implemented through tape drive hardware as well as microcode additions and changes. All 3592 media, including WORM cartridges, can be encrypted. In addition, a new Encryption Key Manager program is designed to support encryption. The Encryption Key Manager program uses standard key repositories on supported platforms. This software will be required to be installed on a supported server and interface with the tape drive to support encryption in a System or Library Managed Encryption implementation.
Note: With encryption enabled, the access time to data on the tape drive will increase. Also, the tape drive unload time will increase. This is due to the time needed to retrieve, read, and write the encryption key.

Statement of general direction

It is IBM s intent to support the following Systems Managed Encryption with the TS1120: z/VM V5.1 and V5.2 support of the TS1120 Tape Drive with encryption is planned for fourth quarter 2006. This includes transparent support for VM guests. z/VM support will require the Encryption Key Manager component running on another operating system other than z/VM using an out-of-band connection. z/TPF V1.1 support of the TS1120 Tape Drive with encryption is planned for the first half 2007. z/TPF support will require the Encryption Key Manager

Encryption will be available for System z and open systems environments. Three different methods of encryption will be supported as follows.
Application Managed: The TS1120 Tape Drive will support Application Managed Encryption for open systems environments. The application will control the encryption
ZG06-0697 -2-

component running on another operating system other than z/TPF using an out-of-band connection. z/VSE V3.1 support of the TS1120 Tape Drive with encryption is planned for first half 2007. It is also IBM s intent to support z/VSE V4.1 (when made available) using Systems Managed Encryption with the TS1120. z/VSE support will require the Encryption Key Manager component running on another operating system other than z/VSE using an out-of-band connection. Linux on System z support (source code) for FICONand ESCON-connected TS1120 Tape Drives is intended to be provided in first half 2007 on developerWorks
http://www.ibm.com/developerworks/linux/ linux390/index.html

The IBM TotalStorage Enterprise Tape Cartridge 3592 available with new models of the 3599 in Product Announcement letter ZG03-0555 dated September 09, 2003

Trademarks
System Storage, i5/OS, System i, System z, System p, System x, FICON, iSeries, and developerWorks are trademarks of International Business Machines Corporation in the United States or other countries or both. AIX, z/OS, TotalStorage, ESCON, Tivoli, AS/400, pSeries, RS/6000, xSeries, z/VM, and z/VSE are registered trademarks of International Business Machines Corporation in the United States or other countries or both. Intel is a registered trademark of Intel Corporation. Windows and Microsoft are trademarks of Microsoft Corporation. Java is a trademark of Sun Microsystems, Inc. Linux is a trademark of Linus Torvalds in the United States, other countries or both. Other company, product, and service names may be trademarks or service marks of others.

IBM will work with its Linux distribution partners to provide this function in future Linux on System z distribution releases or service updates. This future development is designed to help customers with these operating systems utilize the TS1120 Tape Drive to protect tape data. All statements regarding IBM s plans, directions, and intent are subject to change or withdrawal without notice. Any reliance on these Statements of general direction is at the relying party s sole risk and will not create liability or obligation for IBM.

Reference information
Refer to: The IBM TotalStorage 3599 support for the TS1120 Tape Drive format in 3592 Data Cartridges in Product Announcement letter ZG05-0634 dated October 11, 2005 The IBM TotalStorage 3953 Library Manager Model L05 and Tape Frame Model F05 in Product Announcement letter ZG05-0327 dated May 10, 2005 VTS support of the 3592 Tape Drive, other functional enhancements, and 3494 Tape Library enhancements including increased open systems support in Product Announcement letter ZG04-0572 dated October 05, 2004 Support of the 3592 WORM functionality and economy cartridges in the 3494 Tape Library in Product Announcement letter ZG04-0322 dated April 27, 2004 The IBM TotalStorage Enterprise Tape Drive 3592 attachment in the IBM TotalStorage Enterprise Automated Tape Library Models L22, D22, and D24 in Programming Announcement letter ZG03-0556 dated September 09, 2003 The IBM TotalStorage Enterprise Tape Drive 3592 attachment in the IBM TotalStorage Silo Compatible Tape Drive Frame 3592 Model C20 in Product Announcement letter ZG03-0582 dated September 09, 2003 The IBM TotalStorage Enterprise Tape Drive 3592 attachment to ESCON/FICON channels through the IBM System Storage TS1120 Tape Controller 3592 Model C06 in Product Announcement letter ZG06-0387 dated May 09, 2006 The IBM TotalStorage Enterprise Tape Drive 3592 attachment to ESCON/FICON channels through the IBM TotalStorage Enterprise Tape Controller 3592 Model J70 in Product Announcement letter ZG03-0587 dated September 09, 2003
-3ZG06-0697