Thales SafeNet ProtectServer PCIe HSM 5.4 User manual

SafeNet ProtectServer PCIe HSM 5.4
INSTALLATION GUIDE

Document Information
Product Version 5.4
Document Part Number 007-013682-002
Release Date 08 January 2020
Revision History
Revision Date Reason
Rev. A 08 January 2020 Initial release
Trademarks, Copyrights, and Third-Party Software
Copyright 2009-2020 Gemalto. All rights reserved. Gemaltoand the Gemalto logo are trademarks and service
marks of Gemaltoand/or its subsidiaries and are registered in certain countries. All other trademarks and
service marks, whether registered or not in specific countries, are the property of their respective owners.
Disclaimer
All information herein is either public information or is the property of and owned solely by Gemalto and/or its
subsidiaries who shall have and keep the sole right to file patent applications or any other kind of intellectual
property protection in connection with such information.
Nothing herein shall be construed as implying or granting to you any rights, by license, grant or otherwise,
under any intellectual and/or industrial property rights of or concerning any of Gemalto’s information.
This document can be used for informational, non-commercial, internal, and personal use only provided that:
>The copyright notice, the confidentiality and proprietary legend and this full warning notice appear in all
copies.
>This document shall not be posted on any publicly accessible network computer or broadcast in any media,
and no modification of any part of this document shall be made.
Use for any other purpose is expressly prohibited and may result in severe civil and criminal liabilities.
The information contained in this document is provided “AS IS” without any warranty of any kind. Unless
otherwise expressly agreed in writing, Gemaltomakes no warranty as to the value or accuracy of information
contained herein.
The document could include technical inaccuracies or typographical errors. Changes are periodically added to
the information herein. Furthermore, Gemaltoreserves the right to make any change or improvement in the
specifications data, information, and the like described herein, at any time.
Gemalto hereby disclaims all warranties and conditions with regard to the information contained herein,
including all implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In
no event shall Gemalto be liable, whether in contract, tort or otherwise, for any indirect, special or
consequential damages or any damages whatsoever including but not limited to damages resulting from loss
of use, data, profits, revenues, or customers, arising out of or in connection with the use or performance of
information contained in this document.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 2

Gemalto does not and shall not warrant that this product will be resistant to all possible attacks and shall not
incur, and disclaims, any liability in this respect. Even if each product is compliant with current security
standards in force on the date of their design, security mechanisms' resistance necessarily evolves according
to the state of the art in security and notably under the emergence of new attacks. Under no circumstances,
shall Gemaltobe held liable for any third party actions and in particular in case of any successful attack against
systems or equipment incorporating Gemalto products. Gemaltodisclaims any liability with respect to security
for direct, indirect, incidental or consequential damages that result from any use of its products. It is further
stressed that independent testing and verification by the person using the product is particularly encouraged,
especially in any application in which defective, incorrect or insecure functioning could result in damage to
persons or property, denial of service, or loss of privacy.
All intellectual property is protected by copyright. All trademarks and product names used or referred to are the
copyright of their respective owners. No part of this document may be reproduced, stored in a retrieval system
or transmitted in any form or by any means, electronic, mechanical, chemical, photocopy, recording or
otherwise without the prior written permission of Gemalto.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 3

CONTENTS
Preface: About the SafeNet ProtectServer PCIe HSM Installation Guide 5
Customer Release Notes 5
Gemalto Rebranding 6
Audience 6
Document Conventions 6
Notes 7
Cautions 7
Warnings 7
Command Syntax and Typeface Conventions 7
Support Contacts 9
Chapter 1: SafeNet ProtectServer PCIe HSM Hardware Installation 10
SafeNet ProtectServer PCIe HSM Required Items 11
SafeNet ProtectServer PCIe HSM Installation 12
Adapter Features 13
The Card Faceplate 13
The Rear Face 13
Installing the Adapter 14
PCIe HSM Access Provider Installation 14
Smart Card Reader Installation 15
Installing the USB smart card reader 15
Installing the legacy card reader 15
Completing Installation 16
Chapter 2: Troubleshooting 17
Known Issues 17
Simple Fault Diagnosis 17
Chapter 3: Hardware Reference 19
Adapter Modification for External Tamper Detectors 19
The Battery 20
Port Specifications 20
Appendix A: Glossary 21
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 4

Preface: About the SafeNet ProtectServer PCIe HSM Installation Guide
PREFACE:
About the SafeNet ProtectServer PCIe HSM
Installation Guide
The SafeNet ProtectServer PCIe HSM is the second-generation intelligent ProtectServer cryptographic
services PCIe adapter, replacing the ProtectServer PSI-E.
Safenet ProtectServer may employ either generic processing or high-speed DES and RSA hardware
acceleration. Key storage security is ensured by persistent, tamper-protected memory. Multiple adapters may
be installed in a single host computer to improve throughput or provide redundancy.
This guide provides instructions for installing a SafeNet ProtectServer cryptographic services hardware
adapter.
The companion manual, SafeNet HSM Access Provider Installation Guide, provides instructions for installing
the associated SafeNet PCIe HSM Access Provider package (PTKpcihsm2), including the device driver.
This manual contains the following sections:
>"SafeNet ProtectServer PCIe HSM Hardware Installation"on page10
>"Troubleshooting"on page17
>"Hardware Reference"on page19
This appendix provides the adapter's serial port specifications, and instructions for modifying the circuit
board to use external tamper detectors.
>"Glossary"on page21
This preface also includes the following information about this document:
>"Customer Release Notes"below
>"Gemalto Rebranding"on the next page
>"Audience"on the next page
>"Document Conventions"on the next page
>"Support Contacts"on page9
For information regarding the document status and revision history, see "Document Information"on page2.
Customer Release Notes
The customer release notes (CRN) provide important information about this release that is not included in the
customer documentation. It is strongly recommended that you read the CRN to fully understand the
capabilities, limitations, and known issues for this release. You can view or download the latest version of the
CRN for this release at the following location:
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 5

Preface: About the SafeNet ProtectServer PCIe HSM Installation Guide
http://www.securedbysafenet.com/releasenotes/ptk/crn_ptk_5-4.pdf
Gemalto Rebranding
In early 2015, Gemalto completed its acquisition of SafeNet, Inc. As part of the process of rationalizing the
product portfolios between the two organizations, the Luna name has been removed from the SafeNet HSM
product line, with the SafeNet name being retained. As a result, the product names for SafeNet HSMs have
changed as follows:
Old product name New product name
ProtectServer External 2 (PSE2) SafeNet ProtectServer Network HSM
ProtectServer Internal Express 2 (PSI-E2) SafeNet ProtectServer PCIe HSM
ProtectServer HSM Access Provider SafeNet ProtectServer HSM Access Provider
ProtectToolkit C (PTK-C) SafeNet ProtectToolkit-C
ProtectToolkit J (PTK-J) SafeNet ProtectToolkit-J
ProtectToolkit M (PTK-M) SafeNet ProtectToolkit-M
ProtectToolkit FM SDK SafeNet ProtectToolkit FM SDK
NOTE These branding changes apply to the documentation only. The SafeNet HSM
software and utilities continue to use the old names.
Audience
This document is intended for personnel responsible for maintaining your organization's security
infrastructure. This includes SafeNet ProtectToolkit users and security officers, key manager administrators,
and network administrators.
All products manufactured and distributed by Gemalto are designed to be installed, operated, and maintained
by personnel who have the knowledge, training, and qualifications required to safely perform the tasks
assigned to them. The information, processes, and procedures contained in this document are intended for
use by trained and qualified personnel only.
It is assumed that the users of this document are proficient with security concepts.
Document Conventions
This document uses standard conventions for describing the user interface and for alerting you to important
information.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 6

Preface: About the SafeNet ProtectServer PCIe HSM Installation Guide
Notes
Notes are used to alert you to important or helpful information. They use the following format:
NOTE Take note. Contains important or helpful information.
Cautions
Cautions are used to alert you to important information that may help prevent unexpected results or data loss.
They use the following format:
CAUTION! Exercise caution. Contains important information that may help prevent
unexpected results or data loss.
Warnings
Warnings are used to alert you to the potential for catastrophic data loss or personal injury. They use the
following format:
**WARNING** Be extremely careful and obey all safety and security measures. In
this situation you might do something that could result in catastrophic data loss or
personal injury.
Command Syntax and Typeface Conventions
Format Convention
bold The bold attribute is used to indicate the following:
>Command-line commands and options (Type dir /p.)
>Button names (Click Save As.)
>Check box and radio button names (Select the Print Duplex check box.)
>Dialog box titles (On the Protect Document dialog box, click Yes.)
>Field names (User Name: Enter the name of the user.)
>Menu names (On the File menu, click Save.) (Click Menu > Go To > Folders.)
>User input (In the Date box, type April 1.)
italics In type, the italic attribute is used for emphasis or to indicate a related document. (See the
Installation Guide for more information.)
<variable> In command descriptions, angle brackets represent variables. You must substitute a value for
command line arguments that are enclosed in angle brackets.
[optional]
[<optional>]
Represent optional keywords or <variables> in a command line description. Optionally enter the
keyword or <variable> that is enclosed in square brackets, if it is necessary or desirable to
complete the task.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 7

Preface: About the SafeNet ProtectServer PCIe HSM Installation Guide
Format Convention
{a|b|c}
{<a>|<b>|<c>}
Represent required alternate keywords or <variables> in a command line description. You must
choose one command line argument enclosed within the braces. Choices are separated by vertical
(OR) bars.
[a|b|c]
[<a>|<b>|<c>]
Represent optional alternate keywords or variables in a command line description. Choose one
command line argument enclosed within the braces, if desired. Choices are separated by vertical
(OR) bars.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 8

Preface: About the SafeNet ProtectServer PCIe HSM Installation Guide
Support Contacts
Contact method Contact
Phone
(Subject to change. An up-to-
date list is maintained on the
Technical Support Customer
Portal)
Global [phone]
Australia 1800.020.183
India 000.800.100.4290
Netherlands 0800.022.2996
New Zealand 0800.440.359
Portugal 800.863.499
Singapore 800.1302.029
Spain 900.938.717
Sweden 020.791.028
Switzerland 0800.564.849
United Kingdom 0800.056.3158
United States [phone]
Web https://safenet.gemalto.com
Technical Support Customer
Portal
https://supportportal.gemalto.com
Existing customers with a Technical Support Customer Portal account can log in
to manage incidents, get the latest software upgrades, and access the Knowledge
Base. To create a new account, click the Register link at the top of the page. You
will need your Customer Identifier number.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 9

CHAPTER 1:
SafeNet ProtectServer PCIe HSM Hardware
Installation
This chapter describes how to install and connect a SafeNet Protect Server PCIe HSM. To ensure a successful
installation, perform the following tasks in the order indicated:
1. Ensure that you have all of the required components, as listed in "SafeNet ProtectServer PCIe HSM
Required Items"on the next page.
2. Install and connect the hardware, as described in "SafeNet ProtectServer PCIe HSM Installation"on
page12.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 10

Chapter 1: SafeNet ProtectServer PCIe HSM Hardware Installation
SafeNet ProtectServer PCIe HSM Required Items
This section provides a list of the components you should have received with your SafeNet ProtectServer PCIe
HSM order.
Contents Received
The following table contains the standard items you received with your order.
Qty Item
1
SafeNet ProtectServer PCIe HSM Adapter Card, short-form-factor (performance level 25, 220, or 1500, as
ordered, indicated on label).
1
Smart card reader
2
Smart cards (in a single media case)
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 11

Chapter 1: SafeNet ProtectServer PCIe HSM Hardware Installation
Qty Item
1
Protect Toolkit Software DVD (in DVD case)
1
Documentation DVD (in DVDcase)
SafeNet ProtectServer PCIe HSM Installation
Follow these general steps to install and commission a SafeNet ProtectServer PCIe HSM card and its
associated software. More detailed instructions are provided in the following sections.
To install and commission a SafeNet Protectserver PCIe HSM card:
1. Ensure you have all the necessary components on the list provided. For more information, see "Adapter
Features"on the next page.
2. Move the battery jumper from the OFF position to the ON position (see "The Battery Jumper Header"on
page14).
3. If you plan to use an external tamper detector, ensure that it has a two-conductor cable compatible with the
tamper-detect connector on the SafeNet adapter (detailed in "Adapter Modification for External Tamper
Detectors"on page19).
4. Install the SafeNet ProtectServer PCIe HSM card in the host computer system. See "Installing the
Adapter"on page14.
5. Install the HSM Access Provider package and confirm that the adapter and driver are working correctly. See
"PCIe HSM Access Provider Installation"on page14.
6. Install the smart card reader if provided, or another serial device. See "Smart Card Reader Installation"on
page15.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 12

Chapter 1: SafeNet ProtectServer PCIe HSM Hardware Installation
7. Install the SafeNet application programming interface (API) or the supplied net server software. See
"Completing Installation"on page16.
Adapter Features
The SafeNet ProtectServer PCIe HSM is a standard PCIe device that fits into any motherboard PCIe slot of
formats x4, x8, or x16.
The Card Faceplate
The card faceplate has two ports, as shown in "The card faceplate"on page15.
Figure 1: The card faceplate
The MSDM Connector
The micro-D subminiature (MDSM) connector is not used.
The USB Port
The USB port connects a serial device, such as a smart card reader, to the card with the included USB-to-serial
adapter.
The Rear Face
The battery and a series of jumper headers are located on the rear face of the card, as illustrated in "Rear face
of the card"below.
Figure 2: Rear face of the card
The Battery
The battery maintains the internal flash memory. The battery must remain connected for transport mode.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 13

Chapter 1: SafeNet ProtectServer PCIe HSM Hardware Installation
When keeping the HSM in storage (without keys present) it is recommended that you isolate or disconnect the
battery to extend its lifespan. You can use the ctcheck -b batterystatus command to test the battery's
condition. If the Battery Status indication reports as LOW, back up the HSM keys before powering down the
PC.
**WARNING** Disconnecting the battery deletes all key material on the HSM.
Ensure that you back up your HSM before disconnecting the power. The keys are
not deleted immediately. Capacitors continue to supply power for approximately 30
seconds after battery disconnect.
The Battery Jumper Header
The battery jumper is a three-pin jumper used to engage or disengage the battery.
The battery is in the ON position when a jumper is inserted on the center and left pins, as shown in "Rear face
of the card"on the previous page.
The battery is in the OFF position when a jumper is inserted on the center and right pins. This setting is not
required for normal operation.
CAUTION! Do not change the jumper setting unless instructed by SafeNet support.
The Decommission Jumper Header
Place a jumper on the decommission jumper header to decommission the HSM. Decommissioning deletes all
of the key material on the HSM.
The Tamper-Input Header
The tamper-input header connects an external tamper device to the card. By default, it has a jumper in place
across both pins. To use an external tamper device, run a two-wire cable to your chassis-tamper switch or
similar device to open the circuit in the case of a tamper event.
The Polarity Jumper Header
The polarity jumper header is used to configure the card's operating mode. Do not change this jumper setting.
Installing the Adapter
The adapter is a PCI Express Specification 1.1-compliant device. It can be fitted in any spare PCIe slot on the
motherboard of formats x4, x8, or x16. If necessary, please consult the documentation accompanying your
host system motherboard to find the PCIe slots.
If you are using a tamper-detection device, route the cable to it before closing the computer cover.
PCIe HSM Access Provider Installation
After successful installation of the adapter:
1. Install the HSM Access Provider package (PTKpcihsm2).
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 14

Chapter 1: SafeNet ProtectServer PCIe HSM Hardware Installation
2. Confirm the adapter and driver package are operating correctly.
These steps are covered in detail by the SafeNet HSM Access Provider Installation Guide for both Windows
and Unix/Linux systems.
Smart Card Reader Installation
The SafeNet ProtectServer PCIe HSM supports the use of smart cards with a SafeNet-supplied smart card
reader. Readers not supplied by SafeNet are unsupported.
The SafeNet ProtectServer PCIe HSM supports two different card readers:
>the new USB card reader (introduced in 5.2)
>the legacy card reader, which provides a serial interface for data (via a USB-to-serial cable) and a PS/2
interface for power (direct or via a PS/2 to USB adapter)
Installing the USB smart card reader
To install the USB card reader, simply plug the card reader into the HSM USB port, as illustrated in "The card
faceplate"below.
Figure 3: The card faceplate
Installing the legacy card reader
To install the smart card reader, use the included USB-to-serial cable to connect it to the HSM USB port on the
card faceplate as shown in "The connected legacy card reader"on the next page (The illustration shows the
card reader connected to a SafeNet ProtectServer Network HSM).
The legacy card reader must also be connected to a PS/2 port for power. Many newer servers have USB ports,
but do not provide a PS/2 connection.
The options are:
>Use a PS/2-to-USB adapter (pink) to connect the card reader to a USB port on the host computer.
>If you prefer not to expose USB ports on your crypto server (for security reasons), use a PS/2-to-USB
adapter to connect the card reader to a standalone powered USB hub.
The USB connection is for power only. No data transfer occurs.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 15

Chapter 1: SafeNet ProtectServer PCIe HSM Hardware Installation
Figure 4: The connected legacy card reader
Completing Installation
After you have installed the PCIe HSM Access Provider, install the supplied SafeNet API or net server software.
Please refer to the installation instructions in the appropriate manual:
>SafeNet ProtectToolkit-C Administration Guide
>SafeNet ProtectToolkit-J Installation Guide
>SafeNet ProtectToolkit-M User Guide
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 16

CHAPTER 2:
Troubleshooting
The most common problem encountered when installing the SafeNet ProtectServer PCIe HSM is that the
device driver is not loaded or functioning correctly.
Should you encounter any difficulties, first check that you have followed all the installation instructions in this
manual and the HSM Access Provider Installation Guide. The information provided below may be of further
assistance. If you still cannot resolve the issue, please contact your supplier or SafeNet Support. See "Support
Contacts"on page9 for further information.
Known Issues
Problem Solution
The MSI (Microsoft Installer) application does not
complete installation, or is left in an unstable state.
This fault can occur if there are no free IRQs that can be
assigned to the device. Make sure the device is assigned an
IRQ. The IRQs assigned to devices are usually displayed
when a system is powered up.
The system locks up after the HSM Access
Provider device driver package is installed. This
may happen if a prior version of the device driver
exists on the system.
1. Power down and remove the adapter.
2. Power up.
3. Uninstall all versions (old and new) of the HSM Access
Provider / device driver package.
4. Power down and re-install the adapter.
5. Power up and reinstall the HSM Access Provider package.
Following re-installation of a previously removed
adapter or the addition of another adapter, the
device driver cannot find the device or an adapter is
not responding.
Confirm that the adapter(s) are firmly seated in the PCIe slot,
then uninstall the HSM Access Provider package. Following
this, perform a fresh install of the HSM Access Provider
package.
When operating multiple adapters under Windows
2000 or later, the adapters run slowly or even stall.
Some commands may work correctly on one
adapter, but not the other.
This problem may be resolved by resetting the configuration
data in the host system BIOS.
Simple Fault Diagnosis
Fault Diagnosis Utilities
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 17

Chapter 2: Troubleshooting
The SafeNet hardware maintenance utilities hsmstate and hsmresetcan be used to carry out simple fault
diagnosis. These utilities are included in the ProtectServer PCIe HSM Access Provider installation.
For more information, see the HSM Access Provider Installation Guide.
Fault Diagnosis Procedure
From a command prompt, execute hsmstate. The output from the utility should include “... NORMAL mode,
Responding”.
If the utility reports “... HALTED due to a failure”:
1. Execute hsmreset.
2. Following the reset, check to see if the hsmstate is now reporting NORMAL operation.
If the utility reports “... waiting for tamper cause to be removed”:
1. Check to see that any connected external tamper detectors are correctly configured.
2. Make sure the adapter is sitting firmly and correctly in the PCIe slot.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 18

CHAPTER 3:
Hardware Reference
This Appendix contains hardware specifications and instructions on how to fit the HSM with an external tamper
detector such as a micro switch.
Adapter Modification for External Tamper Detectors
Connect additional tamper detection devices using the tamper input header, located on the rear face of the
card, as illustrated in "Rear face of the card"below.
Figure 5: Rear face of the card
To fit an external tamper detection device
1. Remove the default jumper/shunt that bridges the two posts in the ProtectServer adapter's tamper input
header (see "Rear face of the card"above).
2. Connect your external tamper device in the shunt's place.
The cable end from your tamper-detection device must match the Molex socket on the adapter, which is
designed to fit with an insertable connector housing (Molex part 35507-0200).
a. Crimp a pair of 2mm WTB crimp terminals (Molex part 50212-8100) to the ends of your tamper
detector's two-wire connector cable.
b. Insert the crimped terminal sockets into the Molex connector housing.
3. Plug the newly-fitted connector cable into the PCIe adapter's tamper input header.
The external tamper detector must provide the following conditions:
>In the untampered condition, the device must provide a low-impedance path (short circuit) between the
tamper-detection posts.
>In the tampered condition, the device must show an open circuit.
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 19

Chapter 3: Hardware Reference
The Battery
The adapter is fitted with a backup battery, which maintains cryptographic keys and the correct time when the
host computer is shut down, or when the adapter is otherwise disconnected from a power source.
The battery has an expected lifetime of ten years. It should not require replacement within the normal lifetime
of the adapter.
Testing the battery
You can use the utilities provided with the adapter to query the state of the battery. In SafeNet ProtectToolkit-C,
use ctcheck -b batterystatus to return a state of Good/Low. See the Administration Guide for your SafeNet
ProtectToolkit software for more information.
The RealTime Clock and memory retain their data as long as the adapter is in a powered system. The RTC
performs a daily battery check. If it detects a low-battery warning, the battery may need to be replaced. If the
adapter has been de-powered or removed from its system, the data in its memory is suspect. If the adapter has
been continuously powered, then the data in memory can be trusted and you can make a backup before
replacing the battery.
Port Specifications
The USB-to-serial cable provides an RS232 port with pin outs as shown in "Adapter serial connector"below.
This port can be used for connecting a smart card reader or another serial device.
Figure 6: Adapter serial connector
SafeNet ProtectToolkit 5.4 Installation Guide
007-013682-002 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto 20