payShield 10K Installation and User Guide
© Thales Group
Page 187
All Rights Reserved
9.7.2 Duplicating a payShield Manager RLMK card
A copy of an existing RLMK component card can be made using the Duplicate button in payShield Manager's
Operational > LMK Operations > Local Master Keys
tab.
9.8 Loading the new LMK
In the previous sections, we explained how to create a set of cards containing the components for the new LMK.
Each component is “owned” by a different security officer, with no one security officer having access to more than
one component. One holder of each of the required number of components must be present to allow the LMK to be
loaded onto the payShield 10K using the component Smart Cards.
The new LMK now needs to be installed into either LMK Live storage or LMK Key Change storage depending on
the approach being taken.
The new LMK can be loaded using a Console or payShield Manager.
9.8.1 Using the Console
9.8.1.1 Loading (or forming) the LMK
The LMK is loaded using either:
•
the LK console command if the new LMK is to be loaded into LMK Live storage, or
•
the LN console command if the new LMK is to be loaded into LMK Key Change storage.
The payShield 10K must be in the Secure state. In addition, if the LN console command is being used, then the HSM
must be in the Authorized state. If multiple authorized states is enabled, the activity category is admin (with no sub-
category), and the console interface should be selected.
The Smart Cards used must be HSM cards - not cards created for payShield Manager.
9.8.1.2 Checking the LMK
It is recommended that a check is made that the new LMK has been properly loaded.
This can be done using the A console command, to put the HSM into authorized state (followed by the C command
to cancel the authorized state). The A command can be run in any HSM state. The operation of this command
depends on whether multiple authorized activities has been enabled in the security settings (e.g., by using the CS
console command).
Follow this link for additional instruction:
