Configure Luna HSM for SafeNet Authentication Service

This integration assumes that SAS is installed and running. Complete the following to configure the Luna HSM with SAS.

Note

For existing SAS setups, the untouched data is not encrypted till a modification call is made. Once the data is modified, the HSM encryption is applied to it. Any existing data remains unencrypted until it is changed.

To configure Luna HSM for SafeNet Authentication Service:

1. Login to the system as an Administrator where SAS is running.
2. Copy the cryptoki.dll from C:\Program Files\SafeNet\LunaClient folder to the C:\Windows\System32 folder.

3. Open the command prompt and run the iisreset command to reset IIS.

   

4. Launch SAS Manager Console and log in to the SAS Manager Console as an Administrator.

   http://localhost or IP address/console

   

5. Navigate to System > Setup > HSM Database Encryption.

   

6. Click Enable to enable database encryption using an HSM.

7. Enter the Crypto Officer PIN of the HSM partition in the HSM PIN of Slot 0 input field.

8. Click the Apply button. The following message is displayed: HSM database encryption was successfully enabled. The database encryption key was successfully created. In case, a key is already present in the HSM or in the case of a PIN update, an appropriate message is displayed.

   

   

   Note

   If the AES key with Label: HSM_KEY_AES_ENCRYPTION_VER_13 exists in Luna HSM partition, then it uses the existing key. If there is no key with this label, it generates a new key.

9. Verify that the key is being created. To view the key created on Luna HSM partition, run the cmu list command.