Thales SafeNet ProtectServer Network HSM Plus 5.8, Руководство по установке и настройке

Страница: 23 / 42

CHAPTER 3:
Deployment Guidelines
Users must consider the following best practices for security and compliance when deploying SafeNet
ProtectServer Network HSMs for their network/application environment:
> "Secure Messaging System (SMS)" below
> "Networking and Firewall Configuration" on the next page
> "Separation of Roles" on the next page
Secure Messaging System (SMS)
SafeNet ProtectServer HSMs store cryptographic keys and objects in tamper-resistant secure memory, which
is erased when a tamper is detected. The stored keys are accessed through PKCS#11 calls from the client.
Client calls to a Network HSM traverse the network layer (TCP/IP). In the default security mode, this
communication channel between the HSM and the client is unencrypted. Configure the HSM security policy to
improve this channel's security. Refer to
"Security Flags" on page 1
in the
PTK-C Administration Guide
for
descriptions of the available flags and how they affect your implementation.
The Secure Messaging System (SMS) enhances the security of the client-HSM channel. SMS provides an
encrypted channel between the client and the HSM and authenticates messages on that channel using a
Message Authentication Code (MAC) approved by the FIPS 140-2 standard. Refer to
"Secure Messaging" on
page 1
in the
PTK-C Administration Guide
for a detailed description of SMS functionality.
NOTE
SMS encrypts and authenticates messages between the client and HSM, but does
not provide means for the HSM to authenticate client credentials or vice-versa.
The HSM supports the following SMS modes:
>
HIMK
> ADH
> ADH2 (PTK 5.4 and above)
For secure deployment, use ADH or ADH2. Refer to "Secure Messaging" on page 1 in the PTK-C
Administration Guide
for descriptions of the difference between these modes.
The SMS feature is flexible and can be configured to:
> Encrypt/decrypt all messages
>
Sign/verify all messages
> Allow only FIPS-approved mechanisms
> Rotate signing and encryption keys after a specified number of packets or hours
> All of the above
SafeNet ProtectToolkit 5.8 Installation and Configuration Guide
007-013682-006 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto
23