Sansec HSM User manual

Sansec HSM
User Manual v2.2
Beijing Sansec Technology Development Co., Ltd.
July 2016

Welcome to use SANSEC HSM
Copyright (c) 2017 SanSec All right reserved
The contents of this document are subject to change with or without notice. Any
changes to content will not be included within this publication but will be in a newer
release. Our company makes no express or implied warranties, including the content of
the manual on merchantability or implied warranties for the specific purpose.
In accordance with the copyright laws of China, our organization has exclusive rights
and authorities to these resources. No additions, deletion, adaptation, reproduction,
modification or imitation permitted without our organization’s written consent.
Beijing Sansec Technology Development Co., Ltd.
May 2016

Table of contents
1. Product Overview.....................................................................................................................1
1.1. Product Introduction.........................................................................................................1
1.2. Product Functions.............................................................................................................1
1.2.1. Standard Functions...................................................................................................1
1.2.2. Extended Function ...................................................................................................2
1.2.3. Physical Interface......................................................................................................2
1.2.4. Stability and Security................................................................................................3
2. Key Concepts....................................................................................................................................4
3. Quick start guide ..............................................................................................................................6
4. Installation........................................................................................................................................8
4.1. Installation............................................................................................................................8
4.2. Device management.............................................................................................................8
4.3. Start up Management Program.............................................................................................9
4.4. Installation Wizard.............................................................................................................10
5. System Management .............................................................................................................12
5.1. Checking on Device Basic Information .........................................................................12
5.2. Viewing /Modifying Device Maintenance Information.................................................12
5.3. Viewing Device Operating Information.........................................................................12
5.4. Viewing /Modifying Network Configurations...............................................................13
5.5. Viewing /Modifying Financial Application Parameters.................................................13
5.6 View management audit log ....................................................................................................13
6. Authority Management..........................................................................................................15
6.1. Viewing Login Status.....................................................................................................15
6.2. User Login......................................................................................................................15
6.3. User Logoff....................................................................................................................15
6.4. Modify User Password...................................................................................................16
6.5. Administrator management............................................................................................17
6.5.1. Add administrator ..................................................................................................17
6.5.2. Delete administrator ..............................................................................................17
6.6. Operator management........................................................................................................17
6.6.1. Add operator ..........................................................................................................17
6.6.2. Update operator password.....................................................................................18
6.7. Auditor management......................................................................................................18
6.7.1. Add auditor.............................................................................................................18
6.7.2. Update auditor password.......................................................................................19
6.8. Checking Privilege Setting Table.......................................................................................19
7. Key Management ...........................................................................................................................21
7.1. Key Initialization................................................................................................................21
7.2. Setting Local Master Key...................................................................................................21
7.3. RSA Key Management.......................................................................................................21
7.3.1. Generate Key Pair...................................................................................................21
7.3.2. Key Pair Deletion ....................................................................................................22

7.3.3. View Key State .......................................................................................................22
7.4. SM2 Key Management......................................................................................................23
7.4.1. Key Pair Generation................................................................................................23
7.4.2. Key Pair Deletion ....................................................................................................23
7.4.3. View Key State .......................................................................................................23
7.5. ECDSA Key Management................................................................................................24
7.5.1. Key Pair Generation................................................................................................24
7.5.2. Key Pair Deletion ....................................................................................................24
7.5.3. View Key State .......................................................................................................25
7.6. Symmetric Key Management.............................................................................................25
7.6.1. Random Key Generation ........................................................................................25
7.6.2. Key Generation Via Synthesizing Key Segments ....................................................26
7.6.3. Key Deletion ...........................................................................................................28
7.6.4. View Key State .......................................................................................................28
7.6.5. View Key Verification Value ...................................................................................28
7.7. Backup and Recovery....................................................................................................28
7.7.1. Key Backup .............................................................................................................28
7.7.2. Key Recovery ..........................................................................................................30
8. Service Management .............................................................................................................32
8.1. Check Service State .......................................................................................................32
8.2. Check Service Configuration.........................................................................................32
8.3. White List Management.................................................................................................33
8.4. Start or stop service........................................................................................................34
Appendix A：Management - Access Privilege Table ...........................................................................35
Appendix B：Safety Instructions .........................................................................................................36
Appendix C: Technical Support ...........................................................................................................37

Sansec HSM User Manual V2.2
1
1. Product Overview
1.1.Product Introduction
Sansec HSM is a special device developed and designed by Beijing Sansec
Technology Development Co., Ltd. combined with the characteristics of domestic and
foreign financial business applications. It’s mainly used for the host application layer to
encrypt and decrypt data, verify message source correctness and do key management etc.
It can also provide secure data communication services for the networking information
systems to prevent fake cards and other frauds effectively.
The HSM is a high-end information security device. It connects with the business
host through the TCP / IP protocol , with high processing power, stable performance and
other characteristics, applicable to all types of financial information systems, especially
for cross-regional and cross-agency financial transaction systems to provide data
encryption and security protection. It can be widely used in banking, securities, public
transport, petrochemical, urban card and other computer network systems.
1.2.Product Functions
1.2.1.Standard Functions
Sansec HSM is a host peripheral, using its own complex DES, RSA, SM2 and other
encryption algorithms to provide information encryption to ensure that the network and
point to point data security, including the data security on the host and network
communication are working properly.
In general, the standard functions are as below:
Support ATM, POS and other services provided by banks.
Support ANSI and ISO security standard.
Support PIN forwarding and verification.
Support verification of Message authentication Code (MAC).
Support transaction integrity verification.

Sansec HSM User Manual V2.2
2
Support the conversion between DES / 3DES /AES algorithms and Chinese
financial encryption algorithms (SM1 / SM4).
Support IC card key management and card issuing system.
Support key management .
Support complete hardware based true random key generation.
Large-capacity key secure storage space.
Support key generation, distribution, backup, and update.
Support cipher-text data conversion function when the HSM replaces the local
master key.
1.2.2.Extended Function
Support the generation and storage of RSAkey pair, with 2048/3072/4096Bits.
Support the generation and storage of SM2 key pair, with 256Bits.
Support the generation and storage of ECDSA key pair, with the curve
P-256/P-384/P-521.
Support a variety of Public-Key Cryptography Standards, such as PKCS1,
ANSIX9.31, EMV2000, etc.
Support RSA, ECDSA, SM2 signature and verification of data.
Support RSA, SM2 data encryption and decryption operations.
Support the importing of RSA public and private key pairs into the HSM in a
indexing way.
Use physical hardware to generate true random numbers.
Support cryptography letter, cryptography application letter and key letter
printing function, serial port communication parameters and communication
format configuration (support communication speed of 300 ~ 115200bps, 7N1,
7O1, 7E1, 8N1, 8O1 and 8E1 and other communication formats).
1.2.3.Physical Interface
Support TCP/IP protocol，and 10/100/1000M adaptive。
Support gateway setting configuration function when used in cross-network
segment.

Sansec HSM User Manual V2.2
3
Support white list function, and client access HSM IP address filtering function.
Support configuration of the number of TCP socket connections , up to a
maximum of 4096 .
equipped with Independent key management port, host port, printing port;
support a variety of communication protocols that work in parallel.
1.2.4.Stability and Security
System is very stable because its research and development are based on a high
stability, optimized, dedicated operating platform.
Hardware design stratifies FIPS140-2LEVEL3 standard, so it has high security.
Support hierarchical authority management function , so the security of the
devices improved. .
Management commands such as critical operations and key import / export /
conversion need to be executed under administrative privileges.
Support the master key's backup to secure media and recovery from secure
media to HSM.
Support physical double protection mechanism to ensure that the cryptography
system has anti-spying functionality and radiation protection.

Sansec HSM User Manual V2.2
4
2. Key Concepts
Device ID：The device serial number on the label. It consists of the production
date, production batch and a serial number. Combined with the product model, it
can uniquely identify with each product.
Device model：Encryption product model approved by the national
cryptography management agencies.
Digital envelope：A method of enveloping which uses data encryption keys to
protect data and the recipient public key to encrypt and protect the data
encryption key
Digital signature：Signature data attached to the data. It is used to protect and
verify the data source and its integrity as well as to prevent counterfeiting and
denial of issuing.
Key components：At least two random or pseudo random parameters with key
features of the encryption key. The cryptographic key is made through a
combination of one or more of such parameters.
Key segmentation：The key segments are distributed among several key
managers; the key can only be fully recovered when a minimum number of key
managers are present to restore the key.
Key encrypts key（KEK）：The key used to encrypt the session key or file key.
Also known as secondary key or key for transporting key. Each node in the
communication network is assigned one such key.
Key index：The value that represents the numerical key location within the device
or system。
Private signature key：Private key used for signature calculation.
Private encryption key：Used for implementing the private key for data
confidentiality.
Private key access control code：The password used for obtaining the private
key.

Sansec HSM User Manual V2.2
5
Symmetric/private keys：The keys used by a group of specific entities when
using symmetric cryptography.
Session key：Key of the lowest layer within the key management system. The key
is only used for a session within a limited time and will be deleted once the
session ends.

Sansec HSM User Manual V2.2
6
3. Quick start guide
a) Device installation
For more details on installation, refer to chapter 4.1
b) HSM connection
For more details refer to chapter 4.2: Login to HSM
c) Run management tools
For more details refer to chapter 4.3: Start up management program
d) Installation wizard
For more details refer to chapter 4.4: Installation wizard
e) Administrator and operator
For more information, refer to section 6’s administrator guide (chapter 6.5) and
operator guide(chapter 6.6).
f) Modify PIN password
For more information, refer to section 6’s "modify user password (chapter 6.4)"
g) RSA key management
For more information, refer to section 7’s "RSA key management (chapter 7.3)"
h) ECDSA key management
For more information, refer to section 7’s " ECDSA key management (chapter
7.5) "
i) SM2 key management
For more information, refer to section 7’s " SM2 key management (chapter 7.4) "
j) Symmetric key management
For more information, refer to section 7’s "Symmetric key management (chapter