About the FM SDK Programming Guide
A Functionality Module (FM) is a custom-developed, customer-specific code that operates within the secure confines of a Hardware Security Module (HSM).
This document is intended for software developers, as a technical reference which describes the programming methodologies and functions used for the development of Functionality Modules and host-side applications. It also describes the tools and requirements for the management of FMs on compliant HSMs.
FMs allow application developers to design security sensitive program code that can be loaded into the HSM to operate as part of the HSM firmware.
The FM concept allows developers to place their most sensitive algorithms within the logical and physical security perimeter of the HSM. A HSM is the pinnacle of a systems trust pyramid and ultimate solution to the threats of malicious tampering and secret exposure.
FMs can make extensive use of the HSM functionality, which is provided using a PKCS#11 compliant Application Programming Interface (API) and a rich set of commands available just to FMs.
The FM has access to tamper protected persistent storage so it can manage its own keys and critical parameters independently of the PKCS#11 objects.
The FM also has direct access to a RS232 interface (using a USB dongle) of the HSM and can use this port to implement a physically trusted path to an external device.
The Luna FM SDK package allows developers an extensive opportunity to create a large range of customized high security applications.
NOTE This feature requires minimum HSM firmware version 7.4.0
NOTE For Luna Network HSMs, the Client accesses application partitions via NTLS or STC connection, causing the registered application partitions to appear as slots in the lunacm slot list, just as if they were slots on Luna PCIe HSM cards installed locally in the LunaClient host computer.
>For local Luna PCIe HSMs, the HSM Admin (SO) partition (a.k.a. the HSM Admin "Token" in deference to Cryptoki terminology) also appears in the slot list and is directly accessible.
>Be aware that for Luna Network HSMs the HSM Admin partition (HSM Admin token) must be accessed over SSH via the appliance's Lunash administrative interface, and is not visible or accessible via the Client. Use hsm fm commands.
This document describes how to use the FM SDK to write, test, install, and use functionality modules to provide custom functions on the HSM. It contains the following chapters:
>Message Dispatch API Reference
The preface includes the following information about this document:
For information regarding the document status and revision history, see Document Information.
