Entrust nShield User manual

nShield® Trusted
Verification Device
Installation Guide
12.80
17 Nov 2021

Contents
1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê3
2. Safety and security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê4
3. Setting up the nShield Trusted Verification Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5
3.1. Connecting the metal support bracket . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5
3.2. Software installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5
3.3. Connecting an nShield TVD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5
3.4. Disconnecting and reconnecting the nShield TVD. . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6
3.5. Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6
4. Using the nShield Trusted Verification Device. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê7
5. Dimensions and operating temperatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8
5.1. Physical location considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8
nShield® Trusted Verification Device Installation Guide 2 of 9

1. Introduction
The Entrust nShield Trusted Verification Device (TVD) is a USB-connected smart card
reader.
The nShield TVD connects to a laptop or work station. The TVD facilitates the
authentication between the smart card and the HSM. The user is prompted to confirm
the Electronic Serial Number (ESN) of the HSM being displayed on the nShield TVD.
Each time a smart card is inserted a new secure channel between smart card and HSM is
established, when the smart card is removed the secure channel is shut down.
nShield® Trusted Verification Device Installation Guide 3 of 9

2. Safety and security
When the TVD is not being used it must be stored in a secure place.

There are no user-serviceable parts inside the nShield TVD. Any
attempt to dismantle the nShield TVD results in any remaining warranty
cover, the maintenance and support agreement, or both being rendered
void.
To help maintain security:
1. Always inspect the USB cable and the nShield TVD before use.
2. Make sure that the two nCipher tamper seals on the nShield TVD are undamaged
before using the device.
If they are damaged the reader could have been tampered with. If this is the case
please contact Entrust nShield Support: https://nshieldsupport.entrust.com.
3. Never store or carry smart cards with the nShield TVD.
nShield® Trusted Verification Device Installation Guide 4 of 9

3. Setting up the nShield Trusted Verification
Device
3.1. Connecting the metal support bracket
Do the following:
1. Remove the nShield TVD and the metal stand from the packaging.
2. Slide the metal stand into the slots on either side of the TVD.
3. Route the USB cable through the groove in the base of the metal stand (if required).
3.2. Software installation
For software installation instructions, see the Remote Administration Client User Guide,
which is available on the installation media.
3.3. Connecting an nShield TVD
Do the following:
1. Connect the nShield TVD to your computer, using the USB cable.
2. If your operating system detects the nShield TVD automatically, allow it to finish.
nShield® Trusted Verification Device Installation Guide 5 of 9


Do not connect a nShield TVD to your computer with a smart card
already inserted. The nShield TVDÊwill not be recognised and the
message Please remove card will be displayed on the nShield TVD.
When the smart card is removed the message Secoder 2 V2.2.1 will be
displayed and the nShield TVD will be available.
3.4. Disconnecting and reconnecting the nShield TVD
After use, you can disconnect the nShield TVD from the computer’s USB port, and then
reconnect it when you next need to use it.
Do not disconnect the nShield TVD or remove the smart card when
data is being written to the inserted smart card.
3.5. Troubleshooting
If the nShield TVD does not function as expected, disconnect the nShield TVD, wait a few
seconds, and then reconnect it. If this does not solve your problem, contact Entrust
nShield Support: https://nshieldsupport.entrust.com.
nShield® Trusted Verification Device Installation Guide 6 of 9

4. Using the nShield Trusted Verification
Device
Item Description
A: Card slot For inserting a smart card into the TVD, the chip on the card should
face the user and inserted first into the card slot.
B: Display Displays the ESNÊof the HSM.
C: Keypad •0-9, CLR, ˄and ˅: Not used
•C: Used for canceling the current smart card verification
•@: Can be used to show the firmware version and the name of the
reader (status LED flashes at the same time)
Note: Do not press the @ key when there is a smart card in the
card slot because the time taken to display this information can
cause the secure connection between smart card and HSM to be
broken.
•OK: Used to confirm the smart card verification and abort
messages
D: Status LED The status LED will flash when the TVD:
•Is connected to a USBÊport
•Requires the user to confirm a decision. For example, if the C
button is pressed during a smart card verification the LED will
flash and you will be asked to confirm the abort by pressing OK.
nShield® Trusted Verification Device Installation Guide 7 of 9

5. Dimensions and operating temperatures
Parameter Value
Dimensions 62 (w) x 95 (h) x 14 (d) mm
Weight 72g
Powered by USB host device 5V, 200 mA
Operating temperature 0 – 50 °C
Storage temperature -10 – 50 °C
Operating and storage relative humidity Maximum 90% non-condensing
5.1. Physical location considerations
Entrust nShield HSMs are certified to NIST FIPS 140-2 Level 2 and 3. In addition to the
intrinsic protection provided by an nShield HSM, customers must exercise due diligence
to ensure that the environment within which the nShield HSMs are deployed is
configured properly and is regularly examined as part of a comprehensive risk mitigation
program to assess both logical and physical threats. Applications running in the
environment shall be authenticated to ensure their legitimacy and to thwart possible
proliferation of malware that could infiltrate these as they access the HSMs'
cryptographic services. The deployed environment must adopt 'defense in depth'
measures and carefully consider the physical location to prevent detection of
electromagnetic emanations that might otherwise inadvertently disclose cryptographic
material.
When the TVD is not being used it must be stored in a secure place.
nShield® Trusted Verification Device Installation Guide 8 of 9

.
nShield® Trusted Verification Device Installation Guide 9 of 9