in the Security World after replacing the ACS. Failure to do so could result in loss of
administrative access to the Security World.
We recommend that you erase your old Administrator Cards as soon as you have created
the new ACS. An attacker with the old ACS and a copy of the old host data could still re-
create all your keys. With a copy of a current backup, they could even access keys that
were created after you replaced the ACS.
6.13. Firmware upgrade
If you are upgrading a module which has SEE program data or NVRAM-stored keys in its
nonvolatile memory, use the NVRAM-backup utility to backup your data first.
6.14. Enabling and disabling remote upgrade
You can enable or disable the ability to remotely upgrade an nShield Connect. If remote
upgrade is not required this option must be disabled.
6.15. Migrating keys to a v3 Security World
A v3 Security World is a Security World created using a v12.50 (or
later) nShield release.
In additions to the guidance provided in the User Manual, it is strongly recommended
that the following security related guidance is followed when performing key migration
to a v3 Security World:
•
Perform the key migration in a controlled environment, where the Source and
Destination HSMs are logically and physically isolated from all possible external
influences. This will reduce the risk of an external party manipulating the data that is
defining the Destination Security World/HSM
•
Explicitly initialize the Source and Destination Security Worlds onto the Source and
Destination HSMs, so that both the migration tool operator and ACS quorums can
have assurance that the correct Security Worlds are being used, and the keys will be
migrated to the correct Destination Security World
•
The ACS holders (for the Source Security World) should verify the parameters used
in the migration tool to ensure those are correct, before allowing key migration to
proceed (e.g. it is very important that the identifiers for the Destination HSM are
entered correctly, so that the keys are migrated to the correct Destination Security
World).
If application key are migrated to a v3 Security World, it should be noted that the
nShield® Security Manual 47 of 90
To Next Page
Loading...
