Spectra gets backup encryption right

Earlier this year, Spectra Logic became the first vendor to offer tape libraries with hardware encryption. After reviewing a Spectra T120 with LTO3 (Linear Tape-Open 3) drives and hardware encryption, I am more than pleased with the features of this remarkable midtier tape library. Encryption isn’t a data security panacea, but if one of your backup media goes AWOL, you may sleep a little better knowing that its contents were encrypted.

Despite its 160 pounds and 2-foot-by-3-foot size, the T120 is still rack-mountable. (Considering the additional weight of drives and controllers, however, I left mine on the floor.) The T120’s large front door hosts the 4-inch-by-5-inch touchscreen and an import/export shuttle with room for eight cartridges.

Unlocking the door reveals the robotics and cartridge slots, but you’ll rarely open that door because a full-height, 2-inch-wide window makes it easy to inspect the T120’s insides. True to its name, the library has 120 tape slots that you can license gradually as capacity needs increase, starting from 30.

The drives are mounted in, and easily accessible from, the back of the unit. My evaluation unit came with three LTO3 SCSI drives but has room for six full-size LTO or Sony S-AIT drives. You can connect those drives directly to a host or attach to a QIP (Quad Interface Processor) to add FC or iSCSI connectivity. The QIP also holds the library’s encryption capability.

I attached my drives to the QIP via the included SCSI cables and connected its two FC ports to my SAN. There were no problems getting my QLogic SANBox 8 switch to see the library (ditto for the Symantec Veritas Backup Exec 10D), but first I had to set my configuration using the T120 management GUI.

You may access the Spectra T120 management applications in one of three ways: Use the built-in LCD, attach a separate keyboard and mouse to the T120 ports, or connect your browser via HTTP. You will see exactly the same GUI regardless of what method you choose.

The T120 monitors your actions during setup as a safety precaution. To activate my configuration, I first had to enter which drive I was going to connect to which port of the QIP. The T120 then powered down that drive and gave me the OK to proceed with the cabling. After checking that the cabling is correct, the management GUI either activates the new configuration or raises an error flag.

This may seem like having Big Brother watching over your shoulder, but it’s an effective way to minimize configuration errors and prevent inadvertent or malicious configuration changes. I had no problem performing backups and restores in clear, and the library robotics are a head-turner. It’s a tad noisy when shuffling cartridges, but when idle, the T120 is still quieter than most servers.

The T120 uses AES 256-bit hardware-based encryption, so losing a key locks you out of your data. However, you can set up encryption management to work with at least two different users, which minimizes the risk of having only one person controlling all encryption keys.