CHAPTER 1 Planning Your Configuration
you have (the version of the secret that is imprinted on the key) and something you know (the secret that you type in, to
be XOR'd with the contained secret), to make the final secret that unlocks the HSM.
At this point, the key is imprinted. Now the PED inquires if you wish to duplicate the key you just made.
Duplicate
- in general, you should always have duplicate keys for each role (or duplicate M of N sets, per role, if you
chose to invoke the M of N split), so that you can have at least one off-site backup, and probably an on-site standby or
backup set as well. Your security and operational policies will dictate how many sets you need. When the PED prompts
to inquire if you wish to duplicate the current PED Key, you should be ready with the knowledge if you already have
enough copies of that secret or if you need to make more. The more you make, the more you must track. But you must
have enough to satisfy your organization's operational and security protocols.
The above paragraphs explain the meanings of each of the prompts that you would see from Luna PED while
performing an action (like initialization) that imprints PED Keys with secrets. The following sections discuss some
implications of the above choices for specific roles (PED Key colors).
HSM Initialization and the Blue SO PED Key
The first action that invokes Luna PED (which must be connected, as described in the Luna PED option section of the
hardware setup chapter) is HSM initialization.
When you initialize, you are creating an SO (security officer) identity and space on the HSM. In most cases, this is an
administrative position and the only keys or objects that are ever stored there are system keys, not user keys. The SO
sets policy for the overall HSM, and creates partitions.
When creating an access secret for the SO, you are creating a secret for an administrator who sets up the HSM and
then rarely is needed thereafter. You might have a single person who has the job of overseeing several HSMs, in which
case, only the first HSM creates a secret to imprint on a blue PED Key. The second, and all future HSMs to be
administered by that person (or role/job in your organization) would accept that secret from a provided blue PED Key,
rather than creating their own unique SO PED Keys. In that situation, you would choose to "Reuse an existing keyset"
when initializing every HSM after the first one.
Alternatively, you might have a very compartmentalized organization where a separate individual must have
administrative authority over each HSM, so in that case you would use blank blue keys each time you initialized a new
HSM, and each HSM would imprint its own uniquely generated SO secret onto a unique blue key. As well, you would
have the opportunity to apply PED PINs to any or all of the unique SO PED Keys.
Each person who is to act as SO for an HSM must be able to access the appropriate blue PED Key when needed.
Either they carry it with them, or they sign it out when they are using it and sign it back into a secure lockup. If PED
PINs are in use, then each SO and each SO backup/alternate personnel must know the PED PIN(s) for every HSM in
their charge.
If your organization enforces a policy of password changes at certain intervals, or at events like firings and personnel
turnover, then you have options and requirements - you might need to change the secret on the PED Key (
hsm
changePw
command) or you might satisfy the password-changing requirement by simply changing the PED PIN.
Furthermore, when you initialize an HSM with a new secret, you have the opportunity to split that secret using the M of
N feature. In this way, you ensure that a certain minimum number of personnel must be present with their blue PED
Keys whenever the SO must log in. While making that choice, you should choose "M" to be the smallest number that
satisfies the requirement. Similarly, "N" should be large enough to ensure that you have enough "spare" qualified SO
split holders that you can assemble a quorum even when some holders are unavailable (such as for business travel,
vacations, illness). Just as with a single, non-split SO secret, you can apply PED PINs to each blue key in an M of N
set. Consider, before you do, how complicated your administration and key-handling/key-update procedures could
become.
Luna SA Configuration Guide
Release 5.4.1 007-011136-007 Rev C July 2014 Copyright 2014 SafeNet, Inc. All rights reserved.
22
Содержание Luna SA
Страница 1: ...Luna SA Configuration Guide ...
