Offline Data Recovery in SME
The SME solution provides seamless encryption service through a
hardware-based encryption engine. When the MSM-18/4 module or the Cisco MDS
9222i fabric switch is not available, you can use the Offline Data Restore Tool
The offline data recovery in SME is only applicable for SME Tape.
This appendix describes the basic functionalities and operations of
this software application and covers the following sections:
Information About Offline Data Restore Tool
The Offline Data Restore Tool (ODRT) is a standalone Linux application
and is a comprehensive solution for recovering encrypted data on tape volume
groups when the MSM-18/4 module or the Cisco MDS 9222i switch is unavailable.
The ODRT reads the tape volumes, encrypted by SME, and decrypts and
decompresses the data and then writes clear-text data back to the tape volumes.
The following figure shows the topology supported by the ODRT.
Figure 1. Offline Data Restore Tool (ODRT) Topology
The encryption and decryption of data works in the following two steps:
Tape-to-disk– The ODRT reads the encrypted data from the tape and
stores it as intermediate files on the disk.
Disk-to-tape– The ODRT reads intermediate files on the disk,
decrypts and decompresses (if applicable) the data and writes the clear-text
data to the tape.
The decryption key is obtained from the volume group file which you need to export from the Cisco Key Management Center (KMC). For information on exporting volume groups, see Information About SME Key Management
The ODRT feature is invoked by entering the odrt.bin command from the Linux shell.
The prerequistes for running the ODRT tool are as follows:
Platform—The ODRT is currently supported in Red Hat Enterprise Linux 5.
CPU— The little-endian CPU design is supported, such as the x86 family of microprocessors. It is recommended that you use a fast CPU.
Memory— There is no specific limit and a memory of 1 GB to 2 GB would be sufficient.
Disk Sizing— The disk should hold 1 tetrabytes of data.
Fibre Channel (FC) connectivity to the tape drive should be present.