TSM500i and TsmWeb User Guide (PCI HSM v3) (PR-D2-1037 Rev 1.1)
| Page 27
Zazoo Limited, Co. No 9265606 | Directors: Dr S C P Belamant (French),
Mr H G Kotze, Mr P M Belamant | Company Secretary: Ms C W van Straaten
www.zazooltd.com
2.13.3
[Optional] Setting the TSM500i
HSM’s Ope
rational Permissions
The TSM500i firmware supports Access Control, allowing cryptographic officers to enhance system security by
enabling or disabling certain functionality of the HSM.
Two cryptographic officers are required to authenticate themselves to the HSM in order to manage the Access
Control settings.
Two cryptographic officers must login using the KCED in order to enter the
AC:Privileged
mode.
On the
TSM Management
page, locate the table that shows each of the permissions available. The
table lists the state of each of the permissions as well as a recommended state.
Note that this table represents the permissions that will be available to the HSM when in Operational
mode.
To set permissions, edit the text box labelled “Permissions”. This should be a list of permissions
represented by respective mnemonics as shown in the permissions table.
Once all of the required permissions have been entered, and those to be unset removed, click on
Set
permissions
to apply the settings.
The TSM500i must be returned to Operational state to prevent it from remaining in a Privileged state,
which is a security risk
.
2.14
CONFIGURING & TESTING CLIENT SOFTWARE
Client software must be configured to communicate with Conductor and/or the TSM500i, and then tested to
ensure that transaction processing can proceed successfully.
Such configuration and testing will make use of third-party tools that are beyond the scope of this guide.
Consult the software documentation or contact your application vendor for assistance.
2.14.1
Generating and Loading Operational Keys
If key components need to be generated for operational keys the system e.g. Base Derivation Key, PIN
Verification Key and so on, then the same process as that used in section 2.13.1 can be used to generate
components for each operational key.
The loading of operational key components is typically driven by the client software and the HSM needs to be
in the
AC:Privileged
mode when the key components are entered using the KCED.
