Using Transport Mode to Avoid a Board Removal Tamper
Transport mode allows the HSM adapter to be removed from the host system PCI bus without causing a board removal tamper condition. A board removal tamper will remove all sensitive material from the HSM, including the HSM configuration, keys and certificates. When applied to
Only the Administrator can set the required transport mode on the HSM.
Use the command line utility ctconf with the –m option.
To set the Transport Mode
ctconf –m2
The numeric value following the –m switch will set the transport mode to one of the following:
| 0 | No Transport Mode (Default) – to be applied when HSM is installed and configured. This mode will tamper the HSM if it is removed from the PCI bus, the tamper key is turned to the tamper position, or the tamper button is pressed. |
| 1 | Single Transport Mode – HSM will not be tampered after removal from the PCI bus, or when the tamper key is turned to the tamper position, or the tamper button is pressed. HSM will automatically change to No Transport Mode the next time the HSM is reset or power is removed and restored. |
| 2 | Continuous Transport Mode – HSM will not be tampered by removal from the PCI bus, or when the tamper key is turned to the tamper position, or the tamper button is pressed. |
NOTE Transport Mode does not entirely disable the tamper response mechanism. Any attempt to physically attack the HSM will still result in a tamper response.
