|
Home > |
|---|
Your SafeNet USB HSM Cryptographic Module or HSM is shipped in a pre-initialized state,
as part of the factory quality assurance process. However, in that state
the HSM is not associated with Security Officer [SO] or User Authentication
Data, and is not ready to receive or to create and store objects. You
must perform a one-time initialization procedure with the lunacm
utility before the HSM can operate with an application program.
Note: Initialization is meant to be performed only once on an HSM, and it erases any Authentication Data, data or token objects contained on the HSM. Once the HSM is in use, be sure to avoid mistakenly initializing it again. On the other hand, until you put the SafeNet USB HSM into service with actual production data, keys and certificates on it, you can reinitialize it and practice with a variety of optional settings, as many times as you wish.
When you access a SafeNet HSM or HSM Partition, by providing the passwords (Password Authentication versions) or the PED Keys (PED Authentication versions), you open a session. That session remains open until you (or your application) explicitly close it.
Removing power from a SafeNet HSM immediately closes all sessions and causes all volatile data to disappear.
Your application program might not be capable
of logging into the SafeNet USB HSM, on its own. If not, then the program expects
to encounter the HSM already in a logged-in state. For the SafeNet USB HSM to
operate with such an application, you must log into the HSM or its User partition (sometimes referred to as a "token" in some cryptography documentation and discussions) using the
lunacm utility. Find it in your SafeNet HSM Client directory, following
installation. Every time you reboot your computer, you are required to
log into the HSM with the lunacm utility before you can resume
using the SafeNet USB HSM with your application, unless the application is SafeNet HSM-aware.
The SafeNet USB HSM is shipped in different configurations. The Password Authenticated version can be factory configured as an Encryption and Signature HSM (token) or as a Registration Authority (RA) HSM. An RA HSM has the same capabilities as an Encryption and Signature HSM, with the additional ability to wrap private keys off the token for use by smart cards and other applications where multiple secure key generation and issuance is required.
Not every application environment will require rigorous security and paper-trail management, with respect to HSMs and their contents. However, in high-security environments where security and process auditing is mandated, you may be required to refer to a history of any sensitive materials and any systems associated with them -- who had access, what did they do, and when. Rehearse everyday operational activities, as well as maintenance and update activities (Authentication Data [password] update cycles, personnel changes, backups, logging) before implementation in your live environment.
Have all secure physical storage sites and all the related handling procedures prepared in advance. Log your receipt of the SafeNet hardware and then log all storage and handling events thereafter. In an operational environment, you should be able to refer back to a complete “paper trail” – an unbroken record that tracks the existence, storage, handling, and all transitions/hand-offs experienced by each HSM that you ever use. Once you take possession, never allow yourself or your organization to lose track, even briefly, of any of your HSMs or authentication devices (PED Keys, for PED-authenticated HSMs).
If you don't know where a PED Key is, you are not in control of it. If you don't know where it has been, you cannot assert that it has not been copied. If this is ever in doubt, consider resetting or changing passwords/PED Keys. Partition authentication (password, black PED Key if applicable) can be reset with resetPw. Partition or HSM authentication can be changed with changePw. Consider exercising these options if there is any chance an HSM's authentication might have been compromised.
Password integrity is as secure as your personnel choose to keep those passwords.
Physical authentication devices (PED Keys) are as secure as your security policies and procedures and their enforcement.