As new Deployment Plans are created or loaded into Image Streamer, HPE OneView scope management can be
configured to determine which users can provision servers using those Deployment Plans. Artifacts in the Image Streamer
appliance are not subject to scope control, as they are moved between HPE OneView instances.
Artifact developers might require special consideration as they may frequently create new artifacts, and want to test
deployment on servers. These operations require configuring scope and permission to modify a wide set of HPE Synergy
resource types.
Authentication
HPE OneView uses a secure communication channel to communicate with the Image Streamer appliance. During the
creation of an OS deployment server, HPE OneView configures authentication settings for the appliance. After
configuration, HPE OneView retains the credentials for accessing the appliance. When a user invokes an Image Streamer
operation, HPE OneView uses the single sign-on authentication tokens to authenticate the user.
Communication
The following table lists the security mechanisms that protect the different types of data traffic.
Table 5: Security mechanism
Traffic
Security mechanism
REST API calls for Image Streamer management
HTTPS
iSCSI commands for booting the blade servers
IQN authorization
Certificate management
Image Streamer uses HTTPS to communicate with remote servers. HTTPS is based on Transport Layer Security (TLS).
HTTPS and TLS offer the following benefits:
• Confidentiality: Data is encrypted on the wire using symmetric key cryptography.
• Message integrity: Secure hash functions guarantee integrity.
• Authentication: Image Streamer authenticates the remote end point of the HTTPS connection. Public key
cryptography is used to authenticate HTTPS and TLS.
The certificate that gets generated by default on a newly installed appliance is an RSA certificate. Currently, only RSA
certificates are supported for the appliance certificate.
Public key cryptography uses public and private key pairs to encrypt and decrypt data. In a public key system, digital
certificates certify the ownership of the public key. Digital certificates also certify the allowed usage of that key (for
example, digital signatures, certificate signing, encryption).
Image Streamer supports the use of both self-signed certificates and certificate authority-issued (CA) certificates in a
formal public key infrastructure (PKI). The security model for each is different.
The default appliance certificate is a FIPS-compliant SHA-256 certificate with 2048-bit key length.
Security
77