CHAPTER 7
Prepare the Client for Network Trust Link
Network Trust Links (NTL) are secure, authenticated network connections between the Luna SA and Clients. NTLs
use two-way digital certificate authentication and TLS data encryption to protect sensitive data as it is transmitted
between HSM Partitions on the Luna SA and Clients.
On the Luna appliance, port 1792 is used.
NTLs consist of three parts:
•
Network Trust Link Service (NTLS) which resides on the Luna SA
•
Network Trust Link Agents (NTLA) which are installed on Clients
•
The Network Trust Link itself, a secure connection that is created between the NTLS and an authenticated NTLA.
The Luna SA can support up to 800 simultaneous NTL connections. There is some overhead in setting up each link, so
if you are using a large number of links, it is best to stagger their starts, to avoid timeout.
The 800-connection capability is important for client applications that are multi-process based, rather than multi-
threaded.
Preparing the Client
With the assistance of your local network administrator, you should already have prepared the Client system for
network connection. This section is about introducing a Client to the HSM appliance, by creating and exchanging
certificates, so that the two systems recognize each other. Therefore the Client needs all the standard network setup
required of any networked computer — contact your Network Administrator for assistance. This means:
•
Configure all the necessary IP settings (hostname, IP address, DNS, gateway, etc.) as appropriate to your
network, and as applicable to your Client’s operating system.
•
Install an ssh client (the scp copy utility should already have been installed during the HSM software installation).
•
Start network services on your Client machine and verify that you have achieved a proper, working network
configuration (by means of “ping” and other network utilities).
In order to connect a Client to an HSM Partition on the HSM appliance, you must first create a Network Trust Link
(NTL) between them. An NTL consists of:
•
the Network Trust Link Agent (NTLA), a software library that resides on the Client
•
the Network Trust Link Server (NTLS), the server software that manages Network Trust Links on the HSM
appliance and,
•
the NTL itself, an encrypted, secure communications channel between the Client’s NTLA and the HSM appliance's
NTLS.
Network Trust Links use digital certificates to verify the identities of connecting clients. During the initial HSM system
configuration (earlier in this chapter), the Administrator generated a unique certificate that identifies the HSM appliance.
Similarly, each Client must generate its own certificate that identifies it uniquely (next section). Both the Client and the
HSM appliance use these certificates to verify the other’s identity before an NTL is created between them.
Luna SA Configuration Guide
Release 5.4.1 007-011136-007Rev C July 2014 Copyright 2014 SafeNet, Inc. All rights reserved.
91
