Chapter 2: DSM V6100 Hardware Appliance
Administrator Card Set (ACS)
DSM Installation and Configuration Guide
Copyright 2009 - 2020 Thales Group. All rights reserved.
20
ACS
The ACS is created when the initial DSM is configured. If this is an HA cluster, than the initial DSM is designated as
node 1. During ACS creation, you must choose the total number of smart cards contained in your ACS (minimum is
two, recommended is at least three, maximum is 64). This number is called
N
. You must then choose a smaller
number of cards from this set of
N
, which are required to authorize an administrative action. This required number is
called
K
, and is known as the
quorum
.
For example, if you have a single DSM, you can choose to have 6 cards in your ACS (N=6), and 4 cards to authorize
an administrative action (K=4).
Before configuring your DSM, decide both N and K. Remember that in a distributed HA environment, you may want K
cards at each geographic location so you don’t have to ship cards to the different location to perform an administrative
task. However, you may also want to have K+1 cards in case one card goes bad or is unavailable.
The ACS is created during initial DSM configuration. While generating the certificate, you are prompted to insert a
smart card into the reader and to provide an optional passphrase for each card. If a passphrase is specified, it will be
required for subsequent card usage. That is, not only will the card holder have to provide the smart card, but also the
passphrase required for that card. Repeat this procedure for each card in your ACS (N number of times). On
completion of the ACS creation, distribute the cards to the appropriate card holders.
ACS Guidelines
Once you create your ACS, you can never change N and K. You can create a replacement ACS, but N and K remain
the same. Use these guidelines to carefully select the card set.
l
The ACS is crucial: an unusable card set will prevent you from performing administrative operations that require
the ACS.
l
The ACS for the DSM(s) in a standalone or HA environment is created when HA node 1 is configured. You
must
define N and K before you set up HA node 1, and you must decide whether or not to use pass phrases for each
card in the ACS.
l
You can only create an ACS on the initial HA node. It cannot be created on any other HA node. All nodes in a
DSM cluster share the same Security World.
l
Do not create an ACS where K is equal to N because an error on one card would render the whole card set
unusable.
l
Certain administrative tasks on a DSM require only a quorum (K) of smart cards. If you are creating a distributed
HA environment, you’ll probably want enough smart cards to access each of the distributed DSMs in your
environment plus maybe one extra in case one of the cards goes bad.
For example, if you have four distributed DSMs and the quorum, K, is two, you will need at least three smart
cards at each DSM location. This means, that the total number of smart cards, N, must be at least twelve.
l
Choose the optimal K to N ratio for your situation. You cannot change the K or N of your ACS after initial creation.
o
A higher K to N ratio provides greater security, but less convenience. For example if you choose K to be nine
and N to be ten, nine cards must be available to perform an administrative task on any DSM in the system,
and you will have one extra in case one of those nine are not available. On the other hand, making sure those
nine cards are available can provide more logistical problems.
o
A lower K to N ratio provides slightly less security, but more convenience. For example, if you have one local
HA node and three geographically distributed HA nodes, and you choose K to be three and N to be sixteen,
then you could distribute four cards to each DSM location and only three of those cards need to be available.
