Entrust NShield Manual de usuario

nShield®

Security Manual

12.80

17 Nov 2021

Contents

1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5

1.1. Who should read this document? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5

1.2. Products covered by this manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5

1.3. Product security objective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5

1.4. Product selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6

1.5. Security manual authority and scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6

1.6. Related documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6

1.7. Reference documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê7

2. Supply and Transportation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8

2.1. Trusted delivery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8

2.2. Tamper inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8

3. Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê10

3.1. HSM function and architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê10

3.2. HSM environment controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê11

4. Commissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê13

4.1. Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê13

4.2. Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê13

4.3. Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

4.4. Network configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

4.5. Date and Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê16

4.6. nShield Connect and client configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

4.7. Logging and debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê21

4.8. Configure access control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê24

4.9. Configure Security World . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê25

4.10. Remote services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê26

4.11. SEE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê27

5. Access Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê29

5.1. Security World access control architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê29

5.2. Security World access control guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê31

5.3. Application keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê37

5.4. nShield Connect front panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê38

5.5. Configuring the nShield Connect to use a client . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê38

5.6. Role holder lifecycle guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê39

6. Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê42

6.1. Patching policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê42

6.2. Set the RTC time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê42

6.3. Operator Card Set (OCS) quorum configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê42

6.4. NVRAM key storage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê44

nShield® Security Manual 2 of 90

6.5. RFS – configuring auto push . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê44

6.6. Security World replacement options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê44

6.7. Host platform and client applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê44

6.8. Preload utility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê45

6.9. Discarding keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê46

6.10. Erasing a module from a Security World . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê46

6.11. Replacing an OCS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê46

6.12. Replacing the ACS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê46

6.13. Firmware upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê47

6.14. Enabling and disabling remote upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê47

6.15. Migrating keys to a v3 Security World. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê47

7. Key Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê49

7.1. Key management schema. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê49

7.2. Security World security strengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê49

7.3. Application keys algorithms and key sizes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê51

7.4. Cryptoperiods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê51

7.5. Generating random numbers and keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê52

7.6. Key backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê52

7.7. Key import . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê53

7.8. Key separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê53

7.9. nShield JCA/JCE CSP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê53

7.10. nShield PKCSÊ#11 library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê54

8. Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê56

8.1. nShield Edge physical security controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê56

8.2. nShield Solo+ physical security controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê56

8.3. nShield Solo XC physical security controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê57

8.4. nShield Connect physical security controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê58

8.5. nShield card readers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê63

8.6. Tamper inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê63

9. Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê64

9.1. HSM and card reader location. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê64

9.2. ACS and OCS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê64

9.3. Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê64

9.4. Audit logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê65

9.5. Audit Logging time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê66

10. Support and Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê67

10.1. Security Advisories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê67

10.2. Application and Operating System patching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê67

10.3. Connect fan tray module and PSU maintenance. . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê67

10.4. Solo XC fan and battery maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê68

nShield® Security Manual 3 of 90

10.5. Maintenance mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê68

10.6. Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê69

10.7. Contacting Entrust nShield Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê69

11. Security Incident and Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê70

11.1. Security incident monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê70

11.2. Security incident management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê70

11.3. Security incident impact and response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê71

11.4. Deleting a Security World. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê76

11.5. Module failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê77

11.6. Tamper incident. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê77

12. Decommission and Disposal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê78

12.1. nShield Connect and nShield Solo. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê78

Appendix A: Abbreviations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê80

Appendix B: Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê82

nShield® Security Manual 4 of 90

1. Introduction

Good security practice requires procedural as well as technical measures to provide a

comprehensive security environment for the protection of your cryptographic keys and

data.

This guide provides advice to you on the secure operation of the product. It identifies

procedural measures that should be deployed to support the secure operation of the

nShield. The guidance should be used in the development of your Security Operating

Procedures for your systems incorporating the nShield.

1.1. Who should read this document?

The guide should be used by the following people:

•Those responsible for the security policy and procedures for your systems

incorporating the nShield

•Those responsible for commissioning the nShield

•Those responsible for administering the nShield

•Those responsible for auditing the nShield.

1.2. Products covered by this manual

The guide covers the following product variants:

•nShield Edge

•nShield Solo+

•nShield Solo XC

•nShield Connect+

•nShield Connect XC.



In this manual, guidance given for nShield Solo applies to both the

Solo+ and Solo XC product variants. Similarly, guidance given for

nShield Connect applies to both the Connect+ and Connect XC product

variants.

1.3. Product security objective

The nShield range of products provide protection against technical and physical attacks

on keys used to protect your data in use, in motion and at rest. This provides

confidentiality, integrity and availability* of user data up to FIPS 140-2 Level 3 and

nShield® Security Manual 5 of 90

Common Criteria version 3.1 revision 5 EAL 4+ (platform and version dependent) when

deployed in accordance with the technical and procedural controls identified in the User

Guide and Security Manual.

*Some availability threats can be mitigated by hosting a Security World across multiple

Hardware Security Modules (HSMs).

1.4. Product selection

As part of the security product selection process, you must determine that the

functionality delivered by any candidate product meets your requirements.

In this manual the terms module and HSM are both used to generically

describe the nShield range of products.

1.5. Security manual authority and scope

The guide is advisory and its scope is limited to identifying good procedural practices for

the secure operation of the product within your environment.

If there is any contradiction between the guidance that occurs in this manual and that

found in either the Installation guides or User Guides then the guidance found here takes

precedence.

The scope of this manual is limited to security procedural guidance. The Installation

guides and User Guides documents provide guidance on how to implement the controls

discussed in this Manual.

1.6. Related documents

•nShield Solo, nShield Solo XC and nShield Edge User Guide (specific to the operating

environment: Linux and Windows)

nShield® Security Manual 6 of 90

•nShield Connect User Guide (specific to the operating environment: Linux and

Windows)

•CodeSafe Developer Guide

•nShield Connect Physical Security Checklist

•nShield Connect XC Installation Guide

•nShield Edge Installation Guide

•nShield Connect Installation Guide

•nShield nToken Installation Guide

•nShield Solo and nShield Solo XC Installation Guide.

1.7. Reference documents

•Ecrypt-CSA recommendations

•NIST SP 800-57 Part 1 Revision 5

•NIST SP800-131A Revision 1

•Net-SNMP

•NTP Vulnerabilities.

nShield® Security Manual 7 of 90

2. Supply and Transportation

2.1. Trusted delivery

To help assure the integrity of the product during delivery a trusted courier service

should be used that provides traceable delivery progress reporting and requires signed

acceptance of delivery. Inspect the packaging for signs of tampering e.g. packing tape

appears to have been removed or cut and then resealed. If tamper is detected,

quarantine the package and notify your Security Officer in line with your Security

Incident and Response procedures. Similar methods must be deployed by you for any

further transportation of the product during its lifetime. If you utilize a protective

marking scheme, the relevant protective marking must be deployed during

transportation to provide the required level of integrity.

2.2. Tamper inspection

Upon receipt of the nShield HSM, it must be inspected for signs of tamper:

•nShield Edge: Inspect the USB cable and the nShield Edge before use. The

inspection should cover the cable for signs of tampering, the fascia for signs of

disfigurement and specifically the holographic tamper label in the tamper window

shown below for the appearance of VOID.

The nShield Edge Developer Edition does not have a hologram and

tamper window.

•nShield Solo and nShield Solo XC: Examine the epoxy resin security coating (after

removing the metal lid on nShield Solo XC) of the module for obvious signs of

damage.

•Smart card reader: Examine the smartcard reader for signs of tamper and ensure it is

directly plugged into the module or into the port provided by any appliance in which

the module is integrated and the cable has not been tampered with.

•nShield Connect: The nShield Connect Physical Security Checklist, provided in the

box with an nShield Connect and available in the document folder on the installation

media provides details of the physical security checks required. Further guidance on

nShield® Security Manual 8 of 90

physical security checks can be found in Physical Security. Review the nShield

Connect’s tamper log for tamper alerts.

•See Physical Security for further guidance on the management of physical

mechanisms provided to protect the product.

If a tamper is suspected then the unit must be quarantined to investigate the incident.

The unit must not be deployed on the live system until its integrity can be verified. See

the Security Incident and Response for further guidance.

nShield® Security Manual 9 of 90

3. Environment

3.1. HSM function and architecture

The nShield HSMs perform encryption, digital signing and key management on behalf of

an extensive range of commercial and custom-built applications including Public Key

Infrastructures (PKIs), identity management systems, application-level encryption and

tokenization, SSL/TLS, and code signing.

nShield HSMs provide a hardened, tamper-resistant environment for secure

cryptographic processing, key generation and protection and key, data and application

encryption. They are available in three FIPS 140-2 certified form factors to support a

variety of deployment scenarios.

All nShield HSMs integrate with the nShield Security World architecture. This supports

combinations of different nShield HSM models to build a unified ecosystem that delivers

scalability, seamless failover and load balancing. The nShield Security World architecture

supports a specialized key management framework that spans the nShield HSM range.

nShield HSMs all define the physical FIPS-certified security boundary or HSM Layer

within which Application Keys, Control Keys and Infrastructure Keys are protected. Using

quorums of Administrator Card Set (ACS) cards, Infrastructure Keys can be securely

backed up and shared across multiple HSMs. When this is performed, HSMs that share

the same Infrastructure Keys develop a common Security World that provides an

expanded logical security boundary that extends beyond the physical HSM Layer and

overlaps into the enterprise IT environment or Application Layer. The abstraction of

Application Keys into Application Key Tokens enables these tokens to be stored outside

the physical HSM and within the corporate IT environment.

nShield® Security Manual 10 of 90

Otros manuales para nShield

Tabla de contenidos

Manuales populares de Sistema de seguridad de otras marcas

Inner Range

Inner Range Concept 2000 Manual de usuario

Climax

Climax Mobile Lite R32 Instrucciones de montaje

CADDX

CADDX NX-6 Manual de usuario

FBII

FBII XL-31 Series Manual de usuario

Johnson Controls

Johnson Controls PENN Connected PC10 Manual de usuario

Aeotec

Aeotec Siren Gen5 Manual de usuario

Blaupunkt

Blaupunkt SA 2700 Manual de usuario

IDEAL

IDEAL Accenta Manual del propietario

AJAX

AJAX DoubleButton Manual de usuario

Swann

Swann SW-P-MC2 Manual de usuario

Ecolink

Ecolink Siren+Chime Manual de usuario

Digital Monitoring Products

Digital Monitoring Products XR150 Manual de usuario

EDM

EDM Solution 6+6 Wireless-AE Manual de usuario

Highway Safety Group

Highway Safety Group EA401 Manual de usuario

Siren

Siren LED GSM Manual de usuario

Detection Systems

Detection Systems 7090i Instrucciones de montaje

Se-Kure Controls

Se-Kure Controls MicroMini SK-4841 Manual de usuario

Siemens

Siemens FDM273 Manual de usuario

Entrust nShield Manual de usuario

Manuales populares de Sistema de seguridad de otras marcas