CA Dynam for VSE User Guide

IBM Hardware Based Tape Encryption Support
IBM Hardware Based Tape Encryption Support
The IBM JCL statement, Key Encryption Key Label (KEKL), allows a user to
associate a tape unit with one or two key-encryption-key labels. The keyencryption-key
labels are passed to the control unit by the VSE supervisor
which in turn communicates with the Encryption Key Manager (EKM), to
validate the encryption keys. If the key verification is successful, the tape data
will be encrypted when written to the tape. The tape unit specified in the KEKL
statement must already be assigned to an encryption-capable drive before the
KEKL statement is processed by job control.
The KEKL information specified on the KEKL statement can be maintained in
the Dynam catalog. Dynam/T passes the KEKL information to VSE using the
VSE MODCTB macro interface. When requested to do so, Dynam/T finds an
available encryption-capable drive, makes the assignment, and then passes
the appropriate KEKL information to VSE. Defining the KEKL information in the
catalog removes the need to pre-assign encryption capable drives, thus
allowing for automated tape encryption processing. The KEKL information can
be maintained online using CUI and in batch using the DYNCAT DEFIINE and
ALTER commands.
IBM has added four modes to indicate a file should be encrypted when written
to tape. Accordingly, support for new density values has been added to Dynam
which, when specified, indicates that a particular data set should be encrypted
when written to tape.
Note: Even if a dataset is defined with KEKL information, the dataset will only
be encrypted if the dataset is defined with an encryption type density. If the
density specification for the dataset is a non-encryption mode the KEKL
information for the dataset is ignored by CA Dynam/T.
Automatic Cataloging/Uncataloging
Activating Automatic Cataloging
The AUTOCAT(YES) option in the DYNAM/T option record permits automatic
cataloging of new data sets when the first output OPEN is issued; a DYNCAT
DEFINE is not necessary for the data set. If you have selected AUTOCAT(NO),
automatic cataloging is available when the CA Dynam/T TLBL option C is
specified.
Automatic cataloging occurs if all of the following is true:
• An output OPEN request is issued.
• A TLBL exists in the label area matching the dtfname.
2–60 User Guide