USER GUIDE |
USB BACKUP HSM
Page
10
of 31
[5] SECURITY SETTINGS
[5.1] SELF-DESTRUCT PIN
The USB Backup HSM’s Self-Destruct PIN defends against physically compromising situations by erasing the
device’s contents and leaving it to look as if it never had any data written to it.
USE WITH CAUTION! When this mode is activated and the device is unlocked with the Self-Destruct PIN, it will
effectively perform a crypto-erase on the device, deleting all of its data. Additionally, the encryption device
will be deleted and a new encryption device will be created to take its place. When this Self-Destruct PIN is
entered, the device will unlock and the
green
LED will glow solidly as if the device is being normally unlocked.
The device, however, will need to be partitioned and reformatted before it can be used again. Additionally,
The previous Admin and User codes will be deleted in the crypto-erase process and the Self-Destruct PIN will
then become the new Admin PIN to unlock the device.
The Self-Destruct feature can only be enabled or disabled by the Admin. However, the Self-Destruct PIN can be
generated by either the Admin or the User. If the Admin generates the Self-Destruct PIN, only the Admin can
change that PIN. If the User generates the Self- Destruct PIN, both the User and the Admin can change the PIN.
NOTE: The Self-Destruct PIN must be different from the Admin PIN, User PIN, and Recovery PINs.
1. By default, the Self-Destruct feature is disabled. To allow the USB Backup HSM to be set with a Self-
Destruct PIN, Enter the Admin mode. (Hold
+ 0 for five seconds; while the
red
LED is blinking, enter
the Admin PIN and press the
button.) The
blue
LED will glow solidly.
2. Press the 7 and 4 buttons simultaneously. The
green
LED will blink three times, and at this point, the Self
Destruct PIN can now be set by the Admin while the device is in the Admin mode. If the intent is for the
Self-Destruct PIN to be set up at another time by the User, press the
button and refer to the User
Setting Self Destruct PIN instructions below. Otherwise, continue to step 3.
3. Press
+ 3 until the
red
and
blue
LEDs blink alternately.
4. Enter the Self-Destruct PIN and press
. The
green
LED will blink three times and then will return to
red
and
blue
LEDs blinking alternately.
5. Re-enter the Self-Destruct PIN and press
. The
green
LED will glow solidly for a few seconds and then
will return to either the Admin mode (indicated by the
blue
LED glowing solidly) or the unlocked state if
created by User.
6. To enable or disable the Self-Destruct PIN, enter the Admin mode and press the 7 + 4 buttons
simultaneously for a second or two; successful enablement will be indicated by three
green
LED blinks.
successful disablement of Self Destruct mode (press and hold the 7 + 4 buttons again) is indicated by
three
red
LED blinks.
Self-Destruct PIN Set by the User
If the device is enabled for Self-Destruct Mode by the Admin, unlock the device with the User PIN and follow
steps 3 through 5. Additionally, the user can change their Self-Destruct PIN by following these same steps.
Note that the mode can’t be enabled or disabled in the User mode.
