Workflow

The high-level workflow in CCC is outlined below and illustrated in the following figure.

1. Activate CCC to enable authenticated communications with the device HSMs. Activation is required to enable user management, device authorization, service creation, and reporting. See Server Administration.

2. Create user organizations and add users to the organizations. All application Owner users must belong to an organization. See Account Management.

3. Add devices and optionally group them into device pools. See Device Management.

4. Authorize CCC to log in to the devices as the HSM security officer (SO).

5. Import any partitions or partition HA groups that are already configured on the appliance, but that do not exist as services in CCC. You can perform this function at any time. See Discovering and Importing Unmanaged Partitions.

6. Create service templates to define the characteristics of the new services you want to create. All new services must be based on a template. See Service Management.

7. Create new services and assign them to an organization.

8. Initialize the new services. A new service can be initialized by the CCC Administrator or Application Owner.

9. Download the CCC client to the Thales Luna Network HSM client workstation you want to deploy the service on. The CCC client is available for download from CCC by Administrator or Application Owner users. See Service Deployment.

10. As an Application Owner that belongs to the organization that owns a new service, deploy the new service by running the CCC client on the Thales Luna Network HSM client workstation you want to deploy the new service on.

11. Begin using the new service with your cryptographic applications.

User Account Management

CCC Administrators can perform user account management tasks in activated mode only. The main steps are as follows:

1. Log in to CCC as the default Admin user.

2. Change the default password, if this is the first login.

3. Create additional Administrator users, if desired. Administrator users do not belong to an organization.

4. Create the organizations that will own the services you create.

5. Add user accounts for Application Owner users and assign them to an organization.

Application Owner users can only be moved to a new organization by deleting them from their current organization and then adding them to a new organization.

Device Management

CCC Administrators can perform device management tasks in activated mode only. The main steps are as follows:

1. Add the devices you want to manage. To add a device, you must specify the device address and admin login credentials. When you add a device, its capabilities are retrieved from the device, and stored in the database. If the device capabilities change, you can query the device to update the capabilities stored in CCC.

2. To help organize the devices, you optionally create device pools that can contain multiple devices.

3. Place the devices into device pools, if desired.

4. Authorize the devices.

Service Management

CCC Administrators can perform service management tasks in activated mode only. The main steps are as follows:

1. Import any partitions or partition HA groups that are already configured on the appliance, but that do not exist as services in CCC. You can perform this function at any time.

2. Create service templates for each type of new service you wish to create.

3. Create new services and assign them to an organization.

4. Initialize the new service (Administrator or Application Owner user).

5. Generate, view, print, or export reports that provide detailed information for all of your provisioned services.

Service Deployment

Application Owners can deploy services created for their organization in activated mode only. The main steps are as follows:

1. Log on to CCC and initialize the service you want to deploy. Services can be initialized by the Administrator or Application Owner.

2. Download the CCC client to the Thales Luna Network HSM client workstation that will host the service.

3. Run the CCC client to select and deploy the service.

4. Begin using the service with your cryptographic applications.

5. Release the service when it is no longer required. The resources used to provide the service become available to CCC for creating new services.