manualshive.com logo in svg

ZAZO TsmWeb TSM500i, Руководство пользователя

Поделиться
Скачать
ZAZO TsmWeb TSM500i Скачать руководство пользователя страница 42

 

TSM500i and TsmWeb User Guide (PCI HSM v3) (PR-D2-1037 Rev 1.1)

| Page 42 

 

 

 

 

 

 

Zazoo Limited, Co. No 9265606 | Directors: Dr S C P Belamant (French), 

Mr H G Kotze, Mr P M Belamant | Company Secretary: Ms C W van Straaten 

www.zazooltd.com 

4.13

 

Upgrading TSM500i-NSS System Software 

 

This section is only applicable to the 

TSM500i-NSS 

(it does not apply to the TSM500i-PCIe). 

 

 

Upgrading the TSM500i-NSS System Software should not be confused with upgrading the  TSM500i 
HSM Application Firmware.  

 

The TSM500i-NSS consists of a TSM500i hardware security module that interfaces to an embedded computer 
system  (refer  to  the  block  diagram  in  Section  1.2).  The  embedded  computer  system  has  its  own  operating 
system and, amongst other things, runs the Conductor service and provides the TSM-WEB interface. 

It may be necessary from time to time to provide an update to one or more of the software components that 
run on the TSM500i-NSS embedded computer.  

If you receive an NSS software upgrade from Prism the mechanism for these software updates is via the USB 

Service

 port on the front panel of the TSM500i-NSS. The procedure to upgrade is as follows: 

 

Copy the upgrade files the NSS_UPDATES directory to the root path of a USB flash disk 

 

Power the TSM500i-NSS 

off

 

 

Insert the USB flash disk into the 

Service

 port 

 

Power the TSM500i-NSS 

on

  

 

Observe the LCD on the front panel of the TSM500i-NSS. The LCD will display a prompt asking 
whether the updates should be applied. Press the green

 

 

button on the front panel.  

 

Wait until the update process completes, no further user intervention is required 

 

The NSS will automatically execute any required reboots in order to complete its updating 

When the system software upgrade is completed, the LCD will display “TSM500-NSS READY”. The revision of 
the system software is reported during the boot cycle.

 

 

Содержание TsmWeb TSM500i

Страница 1: ...M as well as the TsmWeb interface used to manage this HSM Company Confidential The information in this document is intended only for the person or the entity to which it is addressed and may contain c...

Страница 2: ...kaging in an anti static bag in foam padded box Failure to do so could result in damage to the HSM The original packaging should be kept in a safe place in case it becomes necessary to transport the H...

Страница 3: ...13 2 6 NETWORK SETUP RECOVERY 14 2 6 1 Use the LCD MENU to set the IP address 14 2 7 TSM WEB INTERFACE 15 2 7 1 Invoking TSM WEB for a TSM500i PCIe 15 2 7 2 Invoking TSM WEB for a TSM500i NSS 15 2 7 3...

Страница 4: ...eys 27 3 HSM PASSWORD MANAGEMENT 28 3 1 How to add a Crypto Officer 28 3 2 How to change an existing password 29 3 3 Reset One Password 30 3 4 Reset CSPs clear all passwords and set passwords 31 4 ONG...

Страница 5: ...11 Disabling and Enabling SSL TLS 40 4 11 1 Disable TLS from the LCD MENU 40 4 11 2 Disable or Enable TLS from TSM WEB 40 4 12 Upgrading TSM500i firmware 41 4 13 Upgrading TSM500i NSS System Software...

Страница 6: ...s responsibility to procure and setup a server that will house the TSM500i PCIe Note that a physical computer is required the TSM500i PCIe cannot be installed in a virtual machine It is also necessar...

Страница 7: ...the KCED port on the front panel In the case of a TSM500i PCIe it connects to the RED port on the connector panel this is the connector closest to the status LEDs Whenever the KCED is connected to th...

Страница 8: ...A two step process is used to authenticate the HSM at the place of initial deployment and to simultaneously set the initial 2 crypto officer passwords This process is used to transfer control of the...

Страница 9: ...liance guidelines that are a good reference for creating security procedures A valuable source of information is the PCI PIN Security Requirements At minimum the following issues should be addressed T...

Страница 10: ...packaging and hardware are intact Also verify that is no sign of physical damage Verify that the hardware has not tampered Power on hardware and if red status LED is permanently ON then the hardware...

Страница 11: ...Access to the expansion slot may differ for machines from different vendors please refer to your vendor documentation Remove the TSM500i from the protective static bag To prevent Electro Static Discha...

Страница 12: ...a healthy maintenance state If the module is required to be in the operational state it will need to be reset ON 1 FLASH Tampered state Remove and physically inspect the module according to standard s...

Страница 13: ...Driver folder of the TSM5XX Support CD to select the appropriate driver for your Windows operating system Install Conductor and TSM WEB Run TSM5XX PCI_Installer exe provided on the TSM5XX Support CD...

Страница 14: ...LCD display After about 30 seconds the following prompt will be displayed briefly for menu Press and hold down the red button and green button on the front panel until a MAIN MENU appears on the LCD...

Страница 15: ...Enter http localhost as the URL into your Web Browser when using TSM500i PCIe Note that TSM WEB and Conductor must have been installed see section 2 5 2 7 2 Invoking TSM WEB for a TSM500i NSS When us...

Страница 16: ...after clicking I understand the risks 2 7 3 1 Setting Admin Password for the first time If no admin user password has been set the user will be presented with a screen titled TSM WEB Set Admin Passwor...

Страница 17: ...nutes of inactivity This timeout period can be configured via Preference Manager page on TSM WEB When using TSM WEB on a TSM500i NSS you will always be required to enter a password When using a TSM500...

Страница 18: ...read the Access Control Mode that is reported The Access Control Mode specifies 1 Whether the module is in the Loader state i e running the Boot Loader Loader Tampered state or in the Operational sta...

Страница 19: ...in response to the last challenge issued 2 8 3 Authenticate HSM Finalise Step To perform this operation you must have completed the Request step and received the necessary response from the Manufactu...

Страница 20: ...successful completion of the above step the HSM will have been authenticated to have originated from the Manufacturer and verified to have not been modified 2 8 4 Add additional crypto officers Refer...

Страница 21: ...rt daylight saving time The HSM s date and time is a Critical Security Parameter for certain cryptographic functions and should be corrected at this point This service requires two Crypto Officers to...

Страница 22: ...eration it is strongly recommended that the Default trace level be used This will log all errors and most warnings Selecting either of the other two options Verbose or Debug will result in performance...

Страница 23: ...o login to TSM WEB 2 11 2 Configuring Account and Password Policy TSM WEB account and password policy is configured in the Preference Manager which is accessed by clicking Preference Manager from the...

Страница 24: ...ash drive using the LCD MAIN MENU Power the TSM500i NSS off Insert a USB flash drive into the USB port on the front panel of the TSM500i NSS Power it on again and hold down the red button and green bu...

Страница 25: ...tate is AC OPERATIONAL and then click Login on the TSM Management page The TSM Management page will reload after the cryptographic officers have successfully logged in to the TSM500i Select the tab la...

Страница 26: ...refer to the KCED Installation and User Guide for details on how to use the Key Component Entry Device KCED Procedure Click on the TSM Management page Two cryptographic officers must login using the K...

Страница 27: ...list of permissions represented by respective mnemonics as shown in the permissions table Once all of the required permissions have been entered and those to be unset removed click on Set permissions...

Страница 28: ...r connecting cable for any signs of tampering or insertion of a bugging device Requirements Logged into TSM WEB and the KCED connected to the TSM500i This service can only be performed if the module i...

Страница 29: ...the KCED is connected to the HSM the Cryptographic Officers must inspect the HSM the externally connected device and the inter connecting cable for any signs of tampering or insertion of a bugging dev...

Страница 30: ...r These tokens will only be sent to the email specified on the signed letter The tokens may only be used once where after they will not function Whenever the KCED is connected to the HSM the Cryptogra...

Страница 31: ...where after they will not function Both crypto officers must be present during this command Whenever the KCED is connected to the HSM the Cryptographic Officers must inspect the HSM the externally con...

Страница 32: ...me of the TSM500i NSS reported at bottom of TSM WEB home page and the time of the HSM are correct and synchronized If not setting the date and time in accordance with section 2 9 will set both clocks...

Страница 33: ...ng the procedure provided by the vendor of the software that drives the TSM500i 2 Export the encrypted keys from the database to a CSV Excel file 3 Use Excel to make necessary format changes to ensure...

Страница 34: ...red is visible to nobody except the custodian responsible for the component otherwise the SMK could be compromised 4 4 3 Translate Keys Note After loading the Migration SMK you will need to reload the...

Страница 35: ...the above the status report also provides an Audit Log containing all module Bootloader Audit Log entries This audit log gives the date and time of events such as hardware resets operator logins tamp...

Страница 36: ...until a MAIN MENU appears on the LCD display The arrow keys may be used to select the required option For details on how to navigate and use the MAIN MENU refer to section 2 6 1 or APPENDIX B LCD SEQ...

Страница 37: ...USB flash drive that has the NSS_BACKUPS directory from a previous backup operation is required for a restore Switch the TSM500i NSS off The flash drive should be plugged into the USB Service port on...

Страница 38: ...e Prism TSM WEB service to be stopped and then restarted once the backup is complete Backup the files tsmweb sqlite and tsmweb prop found in C Program Files Prism TsmWeb using a file backup program e...

Страница 39: ...wd option to ERASE the current Admin Password Once this has been done a new Admin Password may be set as described in section 2 7 3 1 4 9 2 Config Reset Selecting the Config reset option from the RESE...

Страница 40: ...gorithm can be changed via the Preferences Manager both RSA and EC key types are supported It must be noted however that EC is not supported in Internet Explorer but has been tested successfully in bo...

Страница 41: ...han the current version then the Crypto Officer role will need to be assumed When updating the TSM500i firmware the Access Control Mode should be BL LOADER_ROLE_OFFICER if loading firmware of same typ...

Страница 42: ...o time to provide an update to one or more of the software components that run on the TSM500i NSS embedded computer If you receive an NSS software upgrade from Prism the mechanism for these software u...

Страница 43: ...environment for a different purpose This service can only be performed if the module is in the Loader state and requires both Crypto Officers to have logged in i e Access Control Mode must be BL LOAD...

Страница 44: ...CER Before clearing the tamper it is advisable to first ascertain the cause of the tamper To do this select the TSM Status page from the side menu and observe what is reported under the headings Activ...

Страница 45: ...y the comma character No field may contain a comma Using double quotes to enclose a field that contains a comma is not valid The double quotes will be assumed to be part of the field value Leading and...

Страница 46: ...in the output file Key space ID Number The ID of the key space under which the key is encrypted Key Type Number The key type as used by the MCM API Key Hex string The key encrypted under the current K...

Страница 47: ...User Guide PCI HSM v3 PR D2 1037 Rev 1 1 Page 47 Zazoo Limited Co No 9265606 Directors Dr S C P Belamant French Mr H G Kotze Mr P M Belamant Company Secretary Ms C W van Straaten www zazooltd com APPE...

Страница 48: ...and TsmWeb User Guide PCI HSM v3 PR D2 1037 Rev 1 1 Page 48 Zazoo Limited Co No 9265606 Directors Dr S C P Belamant French Mr H G Kotze Mr P M Belamant Company Secretary Ms C W van Straaten www zazoo...

Страница 49: ...ards and Technology NSS Networked Security Server refer to TSM500i NSS PC Personal Computer often used to refer to any Windows based computer PCI 1 Payment Card Industry when referring to security sta...

Отзывы:

Нет отзывов

Бренды по названию

Популярные бренды

Загрузить еще бренды