HSM Basic Training
Download as PPTX, PDF40 likes50,386 views
Aamra Technologies Ltd. is a multi-faceted company aimed at modernizing Bangladesh through technology-driven solutions across various sectors. Thales' Payshield 9000 is a widely used hardware security module (HSM) for secure payment transactions, providing essential functions such as PIN validation and key management. The document further details the capabilities, configuration settings, and management of the Payshield 9000 HSM.
![Ethernet TCP Port
Host commands sent via TCP/IP
have been directed to the HSM's
Well-Known Port, and this
continues to be supported.
However, host commands directed
to [the Well-Known Port +1] will
automatically use LMK Id 00; host
commands directed to [the Well-
Known Port +2] will automatically
use LMK Id 01](https://image.slidesharecdn.com/traninghsm-141124071350-conversion-gate01/85/HSM-Basic-Training-33-320.jpg)
![Alarms
CL Command to configure the alarms:
Secure> CL
Please make a selection. The current setting is in parentheses.
Motion alarm [Low/Med/High/ofF] (OFF): H
Save ALARM settings to smart card? [Y/N]: n
QL Command to view the alarms configuration:
Online> QL
Temperature alarm enabled
Motion alarm enabled high sensitivity
Online>
Alarms will log at Audit log and Error log](https://image.slidesharecdn.com/traninghsm-141124071350-conversion-gate01/85/HSM-Basic-Training-54-320.jpg)
HSM Basic Training
- 1. Md. Budrul Hasan Bhuiyan (Shohagh) Assistant Manager aamra technologies ltd.
- 2. About Aamra Aamra is an combination of businesses focused towards catalyzing the modernization of Bangladesh by providing technology driven solutions to their clients in various market segments. For more info please visit www.aamra.com.bd
- 3. Companies of Aamra Textile and Apparels aamra resources limited aamra embroideries limited aamra fashions (cepz) limited Information and Communication Technologies aamra technologies limited aamra networks limited aamra infotainment limited aamra solutions limited aamra outsourcing limited Outsourcing and Professional Development aamra fitness limited aamra management solutions
- 4. www.thalesgroup.com Aerospace Space Defence Security Thales E-Security Transportation
- 5. HSM ?
- 6. Hardware Security Modules (HSMs) Hardware security modules (HSMs) is a tamper-resistant environment for performing secure cryptographic processing, key protection, and key management. With these devices you can deploy high assurance security solutions that satisfy widely established standards for cryptographic systems and practices—while also maintaining high levels of operational efficiency. HSMs are available in multiple form factors to support all common deployment scenarios ranging from portable devices to high-performance data center. Turn to nShield HSMs for general-purpose security, and turn to payShield 9000 for leading payment system security. Whichever HSMs you choose, you will gain confidence in system security and streamline administration and regulatory compliance.
- 8. Thales payShield 9000 Designed specifically for payments applications, payShield 9000 from Thales e- Security is a proven hardware security module (HSM) that performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. payShield 9000 is the most widely deployed payment HSM in the world, used in an estimated 80% of all payment card transactions. The payShield 9000 device is deployed as an external peripheral for mainframes and servers running card issuing and payment processing software applications for the electronic payments industry—delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card transactions.
- 9. Thales payShield 9000 The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, UnionPay, and Visa.
- 10. Thales payShield 9000 Standard functions • Verifying and generating Personal Identification Numbers (PINs) such as those used with bank accounts and credit cards. • Generating encrypted card values such as Card Verification Values (CVVs) for the plastic card industry. • PIN solicitation, to obtain a new PIN from a card holder (against a reference number). • Generating keys for use in Electronic Funds Transfer Point of Sale (EFTPOS) systems. • Key management in non-EFTPOS systems. • Generating and verifying Message Authorization Codes (MACs) for messages transferred via telecommunications networks.
- 11. payShield 9000 HSM in a Typical System
- 12. Thales payShield 9000 Front view
- 13. States are supported by payShield 9000
- 14. Power LED
- 15. Thales payShield 9000 rear view
- 16. Mechanical and Electrical Specifications
- 17. HSM Smartcard The smartcard is used in conjunction with the HSM 8000 and payShield 9000 to securely store: Local Master Key components; HSM configuration details; Remote Manager key material
- 18. LMK and Authorizing officer cards Key 1 and 2 LMK Component 1 LMK Component 2 LMK Component 3 Auth. Officer 1 Auth. Officer 2
- 19. Security Management Controls Operational State - Security Officer Keylocks No Keys - Online – Live Operation 1 Key holder - Offline – Config. and Maintenance 1 and 2 Keys Holder - Secure- Key Load, Config. Alarms
- 20. Connecting to the Console Terminal The console is connected to one of the USB port on the console, using the USB-to- Serial converter cable supplied with the payShield 9000. The USB ports on the HSM have a hierarchy, and it is important that no serial devices are attached to a USB port with a higher priority than the Console. The port hierarchy (from highest to lowest) is: Front left port Front right port Rear port labeled “1” Rear port labeled “2” Rear port labeled “3” If a Console is being attached to a payShield 9000 that has already been in use, it must not be attached to a USB port which has been configured for a printer.
- 21. View the License An HSM license is an electronic file which when loaded into a payShield 9000 HSM, determines the features available to the user. The license is associated with a particular unit's serial number and is therefore not transferable between units. The license will affect such areas as the communication interfaces and the cryptographic algorithms available VR Command is used to view the HSM License information.
- 22. Base Versions payShield 9000 • 1.1a • 1.1b • 1.2a • 1.4c • 1.4d • 2.2a (Obsolete because of Open SSL bug) • 2.2b
- 23. Upload the License to HSM
- 28. LMK – Local Mater Key The local master key is the master key for your HSM, used to protect all other keys in your system. Often be hierarchy of keys. LMK TMK or ZMK TPK or ZPK Data
- 29. LMK Component Generation TRACERT
- 31. LMK Table
- 33. Ethernet TCP Port Host commands sent via TCP/IP have been directed to the HSM's Well-Known Port, and this continues to be supported. However, host commands directed to [the Well-Known Port +1] will automatically use LMK Id 00; host commands directed to [the Well- Known Port +2] will automatically use LMK Id 01
- 34. Configure HSM Settings What is it? • Configuration of sets security parameter and some processing parameters • Pay Shield 9000 must be in secure state • Requires reloading of LMK for security sensitive changes
- 35. Configure HSM Settings PIN length: 04 Encrypted PIN length: 05 Echo: OFF Atalla ZMK variant support: OFF Transaction key support: RACAL User storage key length: SINGLE Select clear PINs: NO Enable ZMK translate command: YES Enable X9.17 for import: YES Enable X9.17 for export: YES Solicitation batch size: 1024 Single-DES: DISABLED Prevent Single-DES keys masquerading as double or triple-length keys: NO ZMK length: DOUBLE Decimalization tables: PLAINTEXT Decimalization table checks: DISABLED
- 36. Configure HSM Settings Continue … PIN encryption algorithm: A Card/password authorisation (local): C Authorised State required when Importing DES key under RSA key: YES Minimum HMAC key length in bytes: 10 Enable PKCS#11 import and export for HMAC keys: YES Enable ANSI X9.17 import and export for HMAC keys: YES Enable ZEK encryption of all printable ASCII chars: YES Enable ZEK encryption of "Base94" ASCII chars: YES Enable ZEK encryption of "Base64" ASCII chars: YES Enable ZEK encryption of "Hex-only" ASCII chars: YES Restrict Key Check Values to 6 hex chars: YES Enable multiple authorised activities: NO Enable variable length PIN offset: NO Enable weak PIN checking: NO Enable Pin Block Format 34 as output format for PIN Translations to ZPK: YES Default LMK identifier: 00
- 37. Configure HSM Settings Continue … Management LMK identifier: 00 Use HSM clock for date/time validation: NO Additional padding to disguise key length: NO Key export and import in trusted format only: NO Protect MULTOS Cipher Data Checksums: NO Document QS Console Command to view the HSM Settings
- 38. Configure HSM Host CH Console Command to configure the HSM Host. From version 2.2b H1 and H2 host port are active. And Version lower 2.2b H1 host is active. Document
- 39. Configure HSM PIN Printer CP command is to configure the PIN Mailer Printer. And QP command is to view the settings. Document
- 40. Printer Communication Serial Printer The payShield 9000 HSM can communicate with a printer via an asynchronous serial connection by employing a USB-to-serial converter cable (supplied by Thales). The USB cable end should be inserted into one of the 4 USB ports on the rear panel of the HSM; the serial cable end should be connected to the printer. The console (CP command) or HSM Manager (Edit > Printer Interface menu) can then be used to select the appropriate configuration for the port. Parallel Printer The payShield 9000 HSM can communicate with a printer via an industry-standard IEEE 1284 parallel connection by employing a USB-to-parallel converter cable (supplied by Thales). The USB cable end should be inserted into one of the 4 USB ports on the rear panel of the HSM; the parallel cable end should be connected to the printer. The console (CP command) or HSM Manager (Edit > Printer Interface menu) can then be used to select the appropriate configuration for the port.
- 41. Configure Console Port To set the baud rate and word format for the console port. The new settings come into effect immediately after the command has completed. The default settings for the Console Port are: 9600 baud, eight data bits, no parity and one stop bit. CC command is to configure the console port and QC is to view the console port configuration. Inputs: Console baud rate. Console word format. Console parity. Console flow control. Document
- 42. Configure Management Port To configure the Management port, which is an Ethernet port used only for management of the HSM. If connection to the host is via Ethernet then the Ethernet host port is used for that purpose. The Management Ethernet port is used to update the HSM's internal software, updating licensing information, and for enabling management of a HSM via the Local or Remote HSM Manager. CM command is to configure the management port and QM is to view the management port configuration. Document
- 43. Save Configuration Security Settings Command SS to save the configuration security settings • Save configure security settings to smartcard • Card needss to be correctly formatted (not formatted for LMK) • Saves just settings form configure commands. RS Command to past configuration settings to HSM
- 45. Main Screen LHM
- 46. LHM File Menu Connect – establish a connection with an HSM. Disconnect – terminate an established connection with an HSM. Login – login using one or two smartcards, to access Operator or Security Officer functions. Logout – terminate the current role, and return to Guest. Load Settings – load HSM settings from a previously saved file. Save Settings – save HSM settings to a selected file. Load Firmware – download a different version of firmware into the HSM. Load Licence – download a different licence into the HSM. Exit – disconnects you from the HSM and closes down the HSM Manager application
- 47. LHM Edit Menu General Settings – to view/modify general HSM settings. Advanced Settings – to view/modify important system settings. Initial Settings – to view/modify sensitive security settings. Host Interface – to view/modify host communications settings. Printer Interface – to view/modify serial and parallel printer communications settings. Management Interface – to view/modify management communications settings. Host Commands – to view/enable/disable individual or groups of host commands. PIN Blocks – to view/enable/disable individual PIN block formats. Auditing – to view/modify the list of audited events. HSM Date/Time – to view/set the HSM’s internal clock. Authorize – to view/set the HSM’s authorized state/activities.
- 48. LHM View Menu Logs – to view/erase the HSM’s internal error and audit logs. HSM Information – to view the HSM information (firmware, licenses, etc.). Remote Details – to view remote management configuration details.
- 49. LHM LMKs Menu Generate Keys – to generate a new LMK onto smart cards. Install LMK – to load a new LMK from smart cards into the HSM. Install ‘Old’ LMK – to load an old LMK from smart cards into the “key change storage” area. Copy LMK Component Card – to create a copy of an existing LMK component card. Create Authorizing Officer Card – to create an LMK Authorizing Officer smartcard from an existing LMK Component Card. Uninstall LMK – to uninstall an LMK from the HSM.
- 50. LHM Keys Menu Generate Keys – to generate specific keys under the LMK. Key Import – to import keys from a different cryptographic zone. Key Export – to export keys to a different cryptographic zone. Generate Components – to generate new key components. Encrypt Components – to encrypt supplied key components using the LMK. Form Key from Components – to form keys from supplied key components.
- 51. LHM Tools Menu Smartcard – to perform smart card management functions. Diagnostics – to perform network management diagnostic functions. Utilities – to perform general utility functions, including: − Calculate Key Check Value − Encrypt Decimalization Table − Translate Decimalization Table − Generate MAC on Issuer Proprietary Bitmap (for CAP/DPA) − Generate CVV/CVC − Generate VISA PVV Utilisation and Health Check Data (payShield 9000 only) – to view and manage the HSM’s utilization and health check data: − Configure Statistics − Health Check Data − HSM Loading Value Host Command Statistics − Reset Statistics
- 52. LHM Tools Menu SNMP (payShield 9000 only) – to configure the SNMP interfaces: − Display – show SNMP Communities/Users − Add – add SNMP Communities/Users − Delete – remove SNMP Communities/Users > Secure Host Communications (payShield 9000 only): − Generate Certificate Signing Request − Export HSM CA Certificate − Import Signed Certificate − Generate HMK − Recover HMK − Change HMK Passphrase − View Certificates − Delete Certificates > Reset Fraud Detection – to restore operation after fraud detection. > Return to Factory Settings – to remove all settings that have been made since the HSM was shipped from the factory
- 53. Audit and Health Check Alarms Utilization Statistics Health Checks Error Log Audit Log
- 54. Alarms CL Command to configure the alarms: Secure> CL Please make a selection. The current setting is in parentheses. Motion alarm [Low/Med/High/ofF] (OFF): H Save ALARM settings to smart card? [Y/N]: n QL Command to view the alarms configuration: Online> QL Temperature alarm enabled Motion alarm enabled high sensitivity Online> Alarms will log at Audit log and Error log
- 55. Utilization Statistics UTILSTATS - Command View/Reset Utilization Data Document
- 56. Health Check HEALTHSTATS -- To display Health Check counts at the Console Document
- 57. ERROR LOG ERRLOG -- To display the entries in the error log CLEARERR -- To clear the entries in the error log Document
- 58. Audit Log AUDITLOG -- To display the entries in the audit log CLEARAUDIT -- To clear the entries in the audit log. Document
- 59. Decommissioning an LMK smart card
- 60. Permanent HSM Decommissioning Permanent decommissioning may become necessary when an HSM reaches the end of its normal operational life. For example it could be replaced by a newer model or by a higher speed model, or the application to which it provides security services is to be discontinued.
- 61. END of the Session