| Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 |    
|
| Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 |
|
| C H A P T E R 1 |
Product Overview |
This chapter provides an overview of the Sun Crypto Accelerator 6000 board, and contains the following sections:
The Sun Crypto Accelerator 6000 board is an 8-lane PCI Express based host bus adapter (HBA) that combines IPsec and SSL cryptographic acceleration with hardware security module (HSM) features. The Sun Crypto Accelerator 6000 board provides improved performance, additional security features, and support for new Oracle Solaris OS on SPARC and x86 platforms, and x86 AMD Opteron platforms running Linux. The combination of a dedicated HSM, advanced cryptographic security, and secure key management specifically meets the security and performance needs for financial services.
Once installed, the board is initialized and configured with the scamgr utility, which manages the keystore and user information, and determines the level of security in which the board operates. Once a keystore and security officer account are configured, Java and PKCS#11 applications such as Sun Java System server software, and OpenSSL applications such as Apache can be configured to use the board for cryptographic acceleration.
The Sun Crypto Accelerator 6000 board supports PIN and credit card related functionality, ensuring the security of sensitive customer data by performing the entire operation within the secure cryptographic boundary of the board. Specialized key management capabilities, and a new user library (libfinsvcs.so) and associated application interface are provided to support this feature. See Chapter 5 for details.
The board supports the following protocols:
The board accelerates the following cryptographic algorithms.
The board accelerates the following SSL functions:
Together with the Oracle Solaris Cryptographic Framework, the board accelerates cryptographic algorithms in both hardware and software. The reason for this complexity is that the cost of accelerating cryptographic algorithms is not uniform across all algorithms. Some cryptographic algorithms were designed specifically to be implemented in hardware, others were designed to be implemented in software. For hardware acceleration, there is the additional cost of moving data from the user application to the hardware acceleration device, and moving the results back to the user application. Note that a few cryptographic algorithms can be performed by highly tuned software as quickly as they can be performed in dedicated hardware.
The Sun Crypto Accelerator 6000 hardware is a low-profile, half-length (6.6 inches [1.67.64 mm] by 2.54 inches [64.41 mm]) 8-lane PCI Express based HBA that enhances the performance of IPsec and SSL, and provides robust security features. FIGURE 1-1 provides an illustration of the board.
FIGURE 1-1 Sun Crypto Accelerator 6000 Board
TABLE 1-2 describes the LED displays.
FIGURE 1-2 shows the location of the LEDs.
The Sun Crypto Accelerator 6000 board has three direct input devices: an RJ-11 serial port, a USB port, and a Point of Presence button.
The six-wire RJ-11 port connector enables direct input adminstration. The port operates at a baud rate of 9600-8N1. The pinout specifications are described in TABLE 1-3 and shown in FIGURE 1-3.
Any device with a properly configured serial port and cable can be used for direct input administration of the device. However, for maximum security a stateless hand-held device ensures that sensitive information and keying material are not compromised. One such device tested is the Termiflex OT/30 hand-held terminal from Warner Power. A Termiflex OT/30 terminal has been configured specifically for use with the Sun Crypto Accelerator 6000 board and can be ordered directly from Warner Power using part number 99-3619-04001 (http://www.termiflex.com/).
FIGURE 1-3 RJ-11 Port Connector Pins
The standard size USB connector enables you to back up and restore the on-board keystore. The port is USB 1.1 compliant and is compatible with standard USB mass storage devices (bulk-only).
Although other USB mass-storage devices will work, only a few devices have been fully tested and qualified for use with the Sun Crypto Accelerator 6000 board. Before using another device for backup and restore operations, verify that diagnostics run successfully with the USB device installed. Choose devices with high transfer speeds and quick response times for the best compatibility with the board.
The following devices have been verified to work with the board:
The Point of Presence button provides physical presence verification when pressed. The physical pressing of this button cannot be emulated remotely.
The Sun Crypto Accelerator 6000 hardware and associated software provide the capability to work effectively on SPARC platforms supporting dynamic reconfiguration (DR) and hot-plugging. During a DR or hot-plug operation, the Sun Crypto Accelerator 6000 software layer automatically detects the addition or removal of a board, and adjusts the scheduling algorithms to accommodate the change in hardware resources.
For High Availability (HA) configurations, multiple Sun Crypto Accelerator 6000 boards can be installed within a system or domain to insure that hardware acceleration is continuously available. In the unlikely event of a Sun Crypto Accelerator 6000 hardware failure, the software layer detects the failure and removes the failed board from the list of available hardware cryptographic accelerators. Sun Crypto Accelerator 6000 software adjusts the scheduling algorithms to accommodate the reduction in hardware resources. Subsequent cryptographic requests are scheduled to the remaining boards.
The Sun Crypto Accelerator 6000 hardware provides a source for high-quality entropy for the generation of long-term keys. If all the Sun Crypto Accelerator 6000 boards within a domain or system are removed, long-term keys are generated with lower-quality entropy.
The Sun Crypto Accelerator 6000 software enables the distribution of load across as many boards as are installed within the Oracle Solaris domain or system. In order to use load sharing, each board must be configured to use the same keystore. See Chapter 4.
TABLE 1-4 provides a summary of the hardware and software requirements for the Sun Crypto Accelerator 6000 board.
The Sun Crypto Accelerator 6000 board supports the Oracle Solaris 10 Operating System on both SPARC and x86 AMD Opteron Linux platforms. The board acts as a cryptographic service provider to the Oracle Solaris Cryptographic Framework, allowing applications to access the board’s functionality with PKCS#11, OpenSSL, and Java (J2SE).
The openCryptoki software interface is used in Linux environments to access the Sun Crypto Accelerator 6000 board. The openCryptoki software provides a user level interface that enables selecting specific cryptographic providers.
Refer to the Sun Crypto Accelerator 6000 Board Product Notes for Version 1.1 for required patch information.
| Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.1 | E39851-01 |
|
Copyright © 2013, Oracle and/or its affiliates. All rights reserved.