CHAPTER 1 Planning Your Configuration
When a partition is created, after the black PED Key is imprinted, you are prompted to provide a domain for the new
partition.
At your option, your partition can:
•
take on the same Cloning Domain (red PED Key) as the HSM in which it resides
•
take on a new, unique Cloning Domain, generated by the HSM at partition creation (no other partition can share
objects with this partition or be configured in HA with this partition, until the newly created domain is shared),
•
take on a cloning domain (from an existing, imprinted red PED Key) that already holds the domain secret for another
partition - this is how you allow the new partition to accept objects from a Backup HSM or to be part of an HA group)
This is how you control which partitions (on the same or different HSMs) share a domain.
Regardless of whether the HSM (SO space) and the partition share a domain, it is not possible to copy/clone objects
between the two. A shared domain between partitions allows you to clone between/among those partitions, and to
make such partitions members of an HA group. All members of an HA group must share a common cloning domain.
On an HSM that supports multiple partitions, all partitions could have the same domain, or all could have different
domains, or some combination could be in effect.
Before you begin the HSM init process, have your black PED Keys ready, either with an existing Partition Owner or
User secret to reuse, or blank (or outdated secret) to be overwritten by a unique new partition Owner secret generated
by the HSM. At the same time, you must also have appropriate red PED Keys ready, because assigning/creating a
cloning domain for the partition is part of the partition creation process. See the previous section, above.
Remote PED Orange PED Key (RPK)
This key is not tied to a fundamental activity like initializing an HSM or creating a partition. Instead, if you don't expect
to use the Remote PED option, you never need to create an orange PED Key.
If you do have a Remote capable Luna PED, and want to use it for remote authentication, rather than always having the
PED locally connected to the HSM, then the HSM and the PED that is remotely hosted must share a Remote PED
Vector (RPV). The RPV is generated by the HSM when you instruct it to set a PED vector and imprinted onto an orange
PED Key, or it is accepted from an existing Remote PED Key and imprinted onto the HSM.
When you invoke "ped vector set" or similar command, to create/imprint a Remote PED Vector, the PED prompt
sequence is similar to the sequence for the blue or black PED keys, with the same questions/choices for you to make
about "reuse" (or a fresh, new secret), about M of N, about duplicates, etc.
Before you begin the PED vector init process, have your orange PED Keys ready, either with an existing RPV secret to
reuse, or blank (or outdated secret) to be overwritten by a unique new RPV secret generated by the HSM. The first time
you set an RPV for an HSM, the PED must be locally connected. After that, you can take the orange PED Key (and
your other PED Keys for that HSM) to any host anywhere that has PedServer running and has a remote-capable Luna
PED attached.
Auditor
The Audit role is completely separate from other roles on the HSM. It is optional for operation of the HSM, but might be
mandatory according to your security regime. The Audit role can be created at any time, and does not require that the
HSM already be initialized.
When you invoke audit init, to create/imprint an Audit role secret, the PED prompt sequence is similar to the sequence
for the blue or black PED keys, with the same questions/choices for you to make about "reuse" (or a fresh, new secret),
about M of N, about duplicates, etc.
Luna SA Configuration Guide
Release 5.4.1 007-011136-007 Rev C July 2014 Copyright 2014 SafeNet, Inc. All rights reserved.
19
Содержание Luna SA
Страница 1: ...Luna SA Configuration Guide ...
