Motorola solutions MCC 7100 IP, Руководство по установке и эксплуатации

Страница: 59 / 170

Keyset information is also stored on software keyfiles. The MCC 7100 IP Dispatch Console reads this
information from the software keyfiles when the dispatch application starts up. It then associates each
key with a talkgroup or a call type (Multiselect (MSEL), Patch) by matching the CKRs. If a match is
successfully found for a talkgroup or a call type, the MCC 7100 IP Dispatch Console can make secure
calls on that talkgroup and able to decrypt incoming audio. If a match is not found, the Dispatch
Console reports key failure during an attempt to use that talkgroup in secure mode.
NOTICE: If Secure/Crypto keys must be loaded after an installation or upgrade of an MCC 7100
IP Dispatch Console software, they can be reloaded at any time after the MCC 7100 IP
Dispatch Console software is installed. A restart of the dispatch application is required to use
any updated loaded keys.
Key Store in the Console Dispatch Status application launches the key storage directory in Windows
Explorer, where the key files are placed. Up to 10 files are read in, from the newest to the oldest. If the
key files format and contents do not pass strict validation rules, errors are reported in the Event Viewer.
Since key files are not created manually, but with the use of the KMF or the Keyfile Generation
application, both key entry tools enforce most of the validation rules. Additional errors that can happen
but cannot be enforced by the key entry tools include:
• Exceeding total supported number of keys across all key files (500)
• Exceeding total supported number of ADP keys across all key files (8)
• Inability to decrypt contents of encrypted keys (no Key Encryption Key (KEK)/invalid KEK in the
MCC 7100 IP Dispatch Console)
• Conflicting entries across multiple key files: entries with the same CKR and keyset values. The key
from the newer keyfile is kept and the duplicate entry from an older keyfile is ignored.
• Conflicting entries across multiple key files: conflicting keyset names and which one is active. In this
case, data from the newer keyfile is kept and a conflicting entry from an older keyfile is ignored.
• No keyfiles exist and thus no keys following an initial installation or an upgrade.
A KMF can manage the MCC 7100 IP Dispatch Console in software encryption mode by generating
keyfiles, which are then copied to the MCC 7100 IP Dispatch Console. Over-the-Ethernet-Keying
(OTEK) is not supported when using software-based key storage. To generate a keyfile on the KMF,
the crypto-administrator creates a group of keys on the KMF and exports it to an XML key file. For
details on this procedure, see
Key Management Facility manual. In this case, each key entry in the file
is encrypted with a Common Key Encryption Key (CKEK). The crypto-administrator distributes the
CKEK to the MCC 7100 IP Dispatch Console, for the MCC 7100 IP Dispatch Console to be able to
decrypt the keys. The MCC 7100 IP Dispatch Console can store up to 20 CKEKs.
The following is an example of the command to execute on the MCC 7100 IP Dispatch Console in
order to store a CKEK:
1
Log on as an administrator.
2 Open a command prompt and execute the following command:
pwvadmin changeproperty -app APP_GROUP_CRYPTO -property keyfile_KEK1 -
value
"Algid=AES256,KeyID=0xF5A1,Key=0x0101010101010101010101010101010101010101
010101010101010101010101"
The format of this command includes password property name “keyfile_KEK1”, “keyfile_KEK2”, …,
“keyfile_KEK20”. The command also includes the name of the algorithm, keyed, and the key material.
Adhere to the order of parameters and spacing between them for the key to be properly stored.
Backing up and restoring the KEKs in the MCC 7100 IP Dispatch Console is essential for restoring
secure communications after an upgrade. However, if you only use clear key files or the
CRYPTRmicro, you need not store KEKs in the MCC 7100 IP Dispatch Console.
If a KMF does not manage secure communications in the MCC 7100 IP Dispatch Console, encryption
keys are entered manually in a spreadsheet and then exported as an XML file. The MCC 7100 IP
MN000672A01-E
Chapter 2: MCC 7100 IP Dispatch Console Setup and Installation
Send Feedback 59