本文档概述了三星电子公司有限公司的安全策略。三星NVME TCG OPAL SSC SSC SEDS PM9A3系列,此处称为“加密模块”或“模块”,SSD(固态驱动器)。此模块满足所有适用的FIPS 140-3安全级别1硬件加密模块要求。它支持基于TCG OPAL SSC的SED(自加密驱动器)功能,该功能旨在保护未经授权访问其NAND Flash存储器中存储的用户数据。加密模块的控制器具有内置的AES硬件硬件,可在没有性能丢失的情况下进行即时加密和解密。SED设计还允许通过加密擦除即时数据消毒。
节级别1。常规2 2。加密模块规范2 3。加密模块接口2 4。角色,服务和身份验证2 5。软件/固件安全2 6。操作环境N/A7。物理安全2 8。非侵入性安全性N/A9。敏感安全参数管理2 10。自我测试2 11。生命周期保证2 12.缓解其他攻击N/A总体2
1.3配置Windows使用FIPS批准的加密算法,有两种方法可以为CryptogrPahic Primitives库启用FIPS批准的模式。首先是使用FIPS本地/组安全策略设置或移动设备管理(MDM)为加密原始图库启用FIPS批准的模式。Windows操作系统提供了一个组(或本地)安全策略设置,“系统密码学:使用符合FIPS的算法进行加密,哈希和签名”。启用加密原语库启用FIPS批准模式的第二种方法是将以下注册表密钥设置为1:HKLM \ System \ CurrentControlset \ Control \ control \ lsa \ fipsalgorithmpolicy \ ste。当此注册表密钥存在并设置为1时,CryptoGaphic Primitives库中的自从库将按照FIPS 140-2实施指导第9.11节运行,并且该模块将处于FIPS批准的模式。除了这些方法外,还请咨询MDM文档以获取有关如何启用FIPS-批准模式的信息。策略CSP-密码学包括设置允许Fipsalgorithmpolicy。更改为批准的模式安全策略设置,直到重新启动计算机后才生效。
Oracle完全致力于多样性和包容性。Oracle尊重和价值观拥有多种劳动力,从而增加了思想领导和创新。作为我们建立一种更具包容性文化的计划的一部分,对员工,客户和合作伙伴产生积极影响,我们正在努力从产品和文档中删除不敏感的术语。我们也是
T ERM D ESCRIPTION ACM Adaptive Coding and Modulation AES Advanced Encryption Standard API Application Programming Interface ASIC Application Specific Integrated Circuit CAVP Cryptographic Algorithm Validation Program CMVP Cryptographic Module Validation Program CSP Critical Security Parameters CVL Component Validation List DAC Digital Access Card DRBG Deterministic Random Bit Generator DSA Digital Signature Algorithm ECCCDH Elliptic Curve Cryptography Cofactor Diffie-Hellman ECDSA Elliptic Curve DSA eM Electrical MUX FIPS Federal Information Processing Standard GUI Graphical User Interface HMAC Keyed-Hash Message Authentication Code INU Intelligent Node Unit IRU Indoor Radio Unit NCC Node Control Card NMS Network Management System NPC Node Protection Card ODU Outdoor Unit OS Operating System RAC Radio Access Card RSA An algorithm for public-key cryptography.首先以Rivest,Shamir和Adleman的名字命名。SHA安全哈希算法SNMP简单网络管理协议SP安全策略存储媒体任何媒体都需要以数据加密形式进行加密模块保护。存储媒体包括内部和外部硬盘驱动器,内存棒和软盘。TCP/IP传输控制协议/Internet协议TDM时线多路复用TLS传输层安全XPIC交叉极化干扰取消
版权所有©2024,Oracle和/或其分支机构。保留所有权利。仅出于信息目的提供此文档,并且此处的内容如有更改,恕不另行通知。本文件不保证是没有错误的,也不应遵守任何其他保证或条件,无论是在法律上表明还是暗示,包括对特定目的的适销性或适用性的隐含保证和条件。Oracle明确违反了对本文档的任何责任,并且本文档直接或间接地形成任何合同义务。本文档可以复制或分布完整,完整且包括本版权通知。
NSHIELD 5S硬件安全模块(HSM)是一种多芯片嵌入式硬件加密模块,如FIPS 140-3所定义,它来自PCI Express板的外形型号,该模块由耐篡改的外壳保护,并在商业范围内执行耐加密,数字签名和密钥管理,并构建商业范围的广泛范围。管理系统,应用程序级加密和令牌化,SSL/TLS和代码签名。
Introduction ..................................................................................................................................................................... 2 About this Document ....................................................................................................................................................... 2免责声明...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................General ................................................................................................................................................................... 5 2.加密模块接口...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Roles, Services, and Authentication .................................................................................................................... 13 4.1 Roles ..................................................................................................................................................................... 13 4.2 Authentication ..................................................................................................................................................... 13 4.3 Services ................................................................................................................................................................. 13 5.Cryptographic Module Specification ..................................................................................................................... 6 2.1 Overall Security Design and Rules of Operation ................................................................................................. 11 2.1.1 Usage of AES-GCM .................................................................................................................................................... 11 2.1.2 RSA and ECDSA Keys ................................................................................................................................................. 11 2.1.3 CSP Sharing ............................................................................................................................................................... 11 2.1.4 Modes of Operation ................................................................................................................................................. 11 3.Software/Firmware Security ................................................................................................................................ 17 5.1 Module Format .................................................................................................................................................... 17 6.Operational Environment .................................................................................................................................... 17 7.Physical Security ................................................................................................................................................... 17 8.Non-invasive Security ........................................................................................................................................... 17 9.Sensitive Security Parameter Management ........................................................................................................ 18 10.Self-Tests .............................................................................................................................................................. 22 10.1 Pre-Operational Self-Tests ................................................................................................................................... 22 10.2 Conditional Self-Tests .......................................................................................................................................... 22 11.Life-Cycle Assurance............................................................................................................................................. 24 11.1 Installation Instructions ....................................................................................................................................... 24 11.1.1 Building for Android ............................................................................................................................................ 24 11.1.2 Building for Linux................................................................................................................................................. 25 11.1.3 Retrieving Module Name and Version .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Mitigation of Other Attacks ................................................................................................................................. 26 References and Standards ..................................................................................................................................................... 27 Acronyms ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
Table of Contents FIPS 140-2 Overview ............................................................................................................................................................ 6 1.Introduction ................................................................................................................................................................. 7 1.1 Scope ................................................................................................................................................................... 7 1.2 Module Overview ................................................................................................................................................. 7 1.3 Module Boundary ................................................................................................................................................ 8 2.Security Level ............................................................................................................................................................... 9 3.Tested Configurations ................................................................................................................................................ 10 4.Ports and Interfaces ................................................................................................................................................... 11 5.Physical Security......................................................................................................................................................... 15 7.Roles, Services and Authentication............................................................................................................................. 12 5.1 Roles .................................................................................................................................................................. 12 5.2 Services ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Operational Environment ........................................................................................................................................... 16 8.加密算法和钥匙管理........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 17 8.1加密算法..................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................电磁干扰/电磁兼容性(EMI/EMC)...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Self-tests .................................................................................................................................................................... 30
8.1 C RYPTO O FFICER G UIDANCE ..................................................................................................... 23 8.1.1 M ODULE I NSTALLATION .................................................................................................................. 23 8.1.2 O PERATING E NVIRONMENT C ONFIGURATION ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... Ransport ............................................................................................................................................................................................................................................................................................................................................................................................................................................... AES-GCM-IV ..................................................................................................................................... RSA AND DSA KEYS ....................................................................................................................... 24 8.2.6 H ANDLING S ELF -T EST E RRORS ......................................................................................................... 24 8.2.7 K EY DERIVATION USING SP 800-132 PBKDF .................................................................................................................................................... 25