Integration with the Entrust nShield Hardware Security Module (HSM)

PAM360 provides robust encryption methods to secure sensitive data. While the default encryption method is AES-256-bit encryption, which secures personal passwords and privileged digital identities in the database, organizations that require enhanced security can benefit from integrating with a Hardware Security Module (HSM).

PAM360 offers seamless integration with Entrust nShield HSM, enabling advanced security through hardware-based data encryption. This integration allows you to utilize hardware-based encryption for the privileged digital identities and personal passwords stored in the PAM360 database. By securing your data encryption key within the HSM, you can safeguard it locally in your environment and achieve FIPS 140-2 compliance, ensuring enhanced data security for privileged identities.

PAM360 supports two modes of encryption with the Entrust nShield HSM:

1. Module Only Key
2. Softcards

This documentation will guide you through the detailed configuration process for these encryption modes and the steps for migrating to Entrust nShield HSM encryption. The following topics are covered in this document:

1. Workflow diagram
2. Configuring the Entrust nShield HSM
3. Migrating to the Entrust nShield HSM Encryption
4. Troubleshooting Tips

1. Workflow Diagram

The integration with Entrust nShield HSM involves several crucial steps. The process begins with installing the HSM and Security World software and concludes with configuring and verifying secure communication between PAM360 and the HSM. Refer to the image below for the complete integration workflow.

2. Configuring the Entrust nShield HSM

2.1 Prerequisites

Ensure you have the following prerequisites before proceeding with the integration:

1. A working instance of PAM360.
2. An nShield Connect HSM.
3. Good connectivity between the PAM360 instance and nShield's Security World.

2.2 Steps to Install the Security World Software

1. Install and configure the Security World software. Refer to the HSM's Installation Guide and the User Guide for detailed instructions.
2. Add the Security World utilities path C:\Program Files\nCipher\nfast\bin to the Windows system path.
3. Check the connectivity between the machine where PAM360 is running and the nShield Security World.
   • Run the anonkneti <Unit IP> command to verify connectivity.
   • The output of this command is <Unit ESN> <Unit KNETI HASH>
   • Here, ESN refers to the Electronic Serial Number.
4. Run the nethsmenroll <Unit IP> command to configure PAM360 to access the nShield HSM.
5. Run the following enquiry utility to ensure the HSM is configured properly.

	C:\Users\Administrator>enquiry
	Server

	enquiry reply flags none
	enquiry reply level Six
	serial number ####-####-####
	mode operational
	...

	Module #1

	enquiry reply flags none
	enquiry reply level Six
	serial number ####-####-####
	mode operational
	...
	

6. Extract and place the world and module files in the following path to complete the configuration:
   • Windows - C:\ProgramData\nCipher\Key Management Data\local
   • Linux - kmdata/local
7. You can run the local bench-marking tests, such as: perfcheck -m1 signing:287, on the machine with the nShield HSM software to verify and optimize the performance of the HSM.
8. Create a Security World for your nShield HSM setup using the new-world -i -m <module_number> -Q >K/N< command based on your organization's security policies. As a precaution, create extra ACS cards for each person with access privileges and a few spares.

   Additional Detail

   Once created, an ACS card set cannot be duplicated.

9. Run the nfkminfo utility to confirm that the Security World is operational.

	C:\Users\Administrator>nfkminfo
	World
	generation 2
	state 0x37270008 Initialised Usable ...
	...
	Module #1
	generation 2
	state 0x2 Usable
	...
	Module #1 Slot #0 IC 0
	generation 1
	phystype SmartCard
	...
	error OK
	...
	Module #1 Slot #1 IC 0
	generation 1
	phystype SoftToken
	...
	error OK
	...

3. Migrating to the Entrust nShield HSM Encryption

Follow these steps to migrate from PAM360's default encryption to the Entrust nShield HSM encryption.

1. Stop the PAM360 service.
2. Open the command prompt and navigate to <PAM360_SERVER_HOME>\bin folder.
3. Execute the following command on the command prompt:
   • Windows - SwitchToHSM.bat
   • Linux - sh SwitchToHSM.sh
4. In the Switch To HSM Encryption window that appears, select Entrust nShield from the HSM Solution drop-down menu.
   
5. For the nShield Features field, choose either Module Only Key or Softcards.
   1. If Module Only Key is selected, no passphrase is required.
   2. If Softcards is selected, enter the Softcard Name and its passphrase in the respective fields.
      
6. Verify the details and click Migrate.
7. Copy the nCipherKM.jar file from the nShield installation folder and paste it into the <PAM360_Installation_Directory>\lib folder
8. Restart the PAM360 service to complete the HSM migration.
9. To verify the encryption method applied, go to the Admin tab in the PAM360 interface and select Configuration >> Encryption and HSM.
   

3.1 Steps to Configure the Entrust nShield HSM in a High Availability Setup

When transitioning to the Entrust nShield HSM as your primary encryption method in your environment with High Availability (HA) configuration, you should reconfigure your HA setup to ensure proper synchronization and functionality across your servers. This process involves installing and configuring the nShield HSM on primary and secondary servers and updating the HSM setup to work seamlessly in the high-availability environment.

1. Install and configure the nShield HSM on both the primary and secondary servers. Follow the specific instructions provided for your database type (PostgreSQL or MS SQL) to set up high availability.
2. Complete the HSM configuration in the HA setup based on your encryption mode.
   1. Module Only Key: Locate the key file in the directory C:\ProgramData\nCipher\Key Management Data\local on the primary server. Copy this key file and place it in the same directory on the secondary server.
   2. Softcards: The directory C:\ProgramData\nCipher\Key Management Data\local will contain two softcard key files. Copy these files from the primary server and place them in the same directory on the secondary server.
3. After copying the files to the secondary server, run the primary and secondary servers to complete the configuration process.

3.2 Steps to Rotate the HSM Key

As a security best practice, it is recommended to rotate encryption keys periodically. To rotate the HSM key, follow the same procedures for rotating the PAM360 encryption key. Click here for the instructions to perform key rotation in HA and non-HA setups.

4. Troubleshooting Tips