| Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.0 |    
|
| C H A P T E R 1 |
|
Product Overview |
This chapter provides an overview of the Sun Crypto Accelerator 6000 Board. Sections include:
The Sun Crypto Accelerator 6000 Board is an 8 lane PCI Express based host bus adapter (HBA) that combines IPsec and SSL cryptographic acceleration with Hardware Security Module (HSM) features. The board provides improved performance, additional security features, and support for new Oracle Solaris OS on SPARC and x86 and x86 AMD Opteron platforms running Linux. The combination of a dedicated HSM, advanced cryptographic security, and secure key management specifically meets the security and performance needs for financial services.
Once installed, the board is initialized and configured with the scamgr utility, which manages the keystore and user information and determines the level of security in which the board operates. Once a keystore and security officer account are configured, Java and PKCS#11 applications such as Sun Java System Application Server software, and OpenSSL applications such as Apache can be configured to use the board for cryptographic acceleration.
The board supports PIN and credit card related functionality, ensuring the security of sensitive customer data by performing the entire operation within the secure cryptographic boundary of the board. Specialized key management capabilities and a new user library (libfinsvcs.so) and associated application interface are provided to support this feature. See Chapter 4 for details.
The board supports the following protocols:
The board accelerates the following IPsec encapsulating security payload (ESP) algorithms.
The board accelerates the following SSL algorithms.
The board accelerates the following SSL functions:
Together with the Oracle Solaris Cryptographic Framework, the board accelerates cryptographic algorithms in both hardware and software. The reason for this complexity is that the cost of accelerating cryptographic algorithms is not uniform across all algorithms. Some cryptographic algorithms were designed specifically to be implemented in hardware, others were designed to be implemented in software. For hardware acceleration, there is the additional cost of moving data from the user application to the hardware acceleration device, and moving the results back to the user application. Note that a few cryptographic algorithms can be performed by highly tuned software as quickly as they can be performed in dedicated hardware.
The Sun Crypto Accelerator 6000 hardware is a low profile, half length (6.6 inches [1.67.64 mm] by 2.54 inches [64.41 mm]) 8 lane PCI-Express based HBA that enhances the performance of IPsec and SSL and provides robust security features. FIGURE 1-1 provides an illustration of the board.
FIGURE 1-1 Sun Crypto Accelerator 6000 Board
TABLE 1-3 describes the LED displays.
FIGURE 1-2 shows the location of the LEDs.
The Sun Crypto Accelerator 6000 Board has three direct input devices: an RJ-11 serial port, a USB port, and a point of presence button.
The six wire RJ-11 port connector enables direct input adminstration. The port operates at a baud rate of 9600-8N1. The pinout specifications are described in TABLE 1-4 and shown in FIGURE 1-3.
Any device with a properly configured serial port and cable can be used for direct input administration the device. However, for maximum security it is suggested that a stateless hand-held device be used to ensure sensitive information and keying material are not compromised. One such device tested and suggested is the Termiflex OT/30 Hand-held Terminal from Warner Power. A Termiflex OT/30 Terminal has been configured specifically for use with the board and can be ordered directly from Warner Power using part number
99-3619-04001 (http://ec.transcendusa.com/)
FIGURE 1-3 RJ-11 Port Connector Pins
The standard size USB connector enables you to backup and restore the onboard keystore. The port is USB 1.1 compliant and is compatible with standard USB mass storage devices (bulk-only).
Although other USB mass-storage devices work, only the JetFlash 2.0 USB Flash drive from Transcend has been fully tested and qualified for use with the board. Before using another device for backup and restore operations, verify that diagnostics run successfully with the USB device installed. Choose devices with high transfer speeds and quick response times for the best compatibility with the board (http://www.termiflex.com/).
The point of presence button provides physical presence verification when pressed. The physical pressing of this button cannot be emulated remotely.
The Sun Crypto Accelerator 6000 hardware and associated software provide the capability to work effectively on SPARC platforms supporting dynamic reconfiguration (DR) and hot-plugging. During a DR or hot-plug operation, the Sun Crypto Accelerator 6000 software layer automatically detects the addition or removal of a board, and adjusts the scheduling algorithms to accommodate the change in hardware resources.
For High Availability (HA) configurations, multiple Sun Crypto Accelerator 6000 boards can be installed within a system or domain to insure that hardware acceleration is continuously available. In the unlikely event of a Sun Crypto Accelerator 6000 hardware failure, the software layer detects the failure and removes the failed board from the list of available hardware cryptographic accelerators. Sun Crypto Accelerator 6000 software adjusts the scheduling algorithms to accommodate the reduction in hardware resources. Subsequent cryptographic requests are scheduled to the remaining boards.
Note that the Sun Crypto Accelerator 6000 hardware provides a source for high-quality entropy for the generation of long-term keys. If all the Sun Crypto Accelerator 6000 boards within a domain or system are removed, long-term keys are generated with lower-quality entropy.
The Sun Crypto Accelerator 6000 software enables the distribution of load across as many boards as are installed within the Oracle Solaris domain or system. Incoming cryptographic requests are distributed across the boards based on fixed-length work queues. Cryptographic requests are directed to the first board, and subsequent requests stay directed to the first board until it is running at full capacity. Once the first board is running at full capacity, further requests are queued to the next board available that can accept the request of this type. The queueing mechanism optimizes throughput by facilitating request coalescing at the board.
TABLE 1-5 provides a summary of the hardware and software requirements for the Sun Crypto Accelerator 6000 Board.
|
Oracle Solaris 10, Red Hat EL 4.0*, SuSE Enterprise 9.0*, and future compatible releases of these operating systems. |
The board supports the Oracle Solaris 10 operating system on both SPARC and x86 AMD Opteron Linux platforms. The board acts as a cryptographic service provider to the Oracle Solaris Cryptographic Framework, allowing applications to access the board’s functionality with PKCS11, OpenSSL, and JAVA (J2SE).
The openCryptoki software interface is used based on support by both the Red Hat EL 4.0 and SuSE Enterprise 9.0 Linux distributions. openCryptoki provides a user level interface that allows selecting specific cryptographic providers.
Refer to the Sun Crypto Accelerator 6000 Board Product Notes for Version 1.0 for detailed required patch information.
| Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.0 | 819-5536-12 |
|
Copyright © 2010, Oracle and/or its affiliates. All rights reserved.