hsm:entrustnshieldgroup : The Entrust nShield Harware Security Module group object.

You can integrate a Grid with a third-party, network-attached Hardware Security Modules (HSMs) for secure private key storage and generation, and zone-signing offloading. Infoblox appliances support integration with either Thales Luna HSMs or Entrust nShield HSMs. When using a network-attached HSM, you can provide tight physical access control, allowing only selected security personnel to physically access the HSM that stores the DNSSEC keys.

The Entrust nShield Hardware Security Module (HSM) group represents the collection of Entrust nShield HSM devices that are used for private key storage and generation.

Note that you can create one Entrust nShield HSM group in the Grid.

Object Reference

References to hsm:entrustnshieldgroup are object references.

The name part of the Entrust nShield HSM object reference has the following components:

• The Entrust nShield HSM group name

Example:

hsm:entrustnshieldgroup/ ZG5zLm9wdGlvbl9kZWZpbml0aW9uJGluZm8uLmZhbHNlLjI1Mg:group1

Restrictions

The object does not support the following operations:

• Global search (searches via the search object)
• Scheduling
• CSV export

The object cannot be managed on Cloud Platform members.

Fields

These fields are actual members of the object; thus, they can be requested by using _return_fields, if the fields are readable.

The basic version of the object contains the field(s): comment, key_server_ip, name.

The following fields are required to create this object:

Field	Notes
card_name	See the field description for more information
entrustnshield_hsm
key_server_ip
name
pass_phrase	See the field description for more information

card_name

card_name

The Entrust nShield HSM softcard name.

Type

String.

Create

You must specify card_name when protection is set to ‘SOFTCARD’.

Search

The field is not available for search.

comment

comment

The Entrust nShield HSM group comment.

Type

String.

Create

The default value is empty.

Search

The field is available for search via

• ‘:=’ (case insensitive search)
• ‘=’ (exact equality)
• ‘~=’ (regular expression)

Notes

The comment is part of the base object.

entrustnshield_hsm

entrustnshield_hsm

The list of Entrust nShield HSM devices.

Type

A/An Entrust nShield Hardware Security Module struct array.

Create

The field is required on creation.

Search

The field is not available for search.

key_server_ip

key_server_ip

The remote file server (RFS) IPv4 Address.

Type

String.

Create

The field is required on creation.

Search

The field is not available for search.

Notes

The key_server_ip is part of the base object.

key_server_port

key_server_port

The remote file server (RFS) port.

Type

Unsigned integer.

Create

The default value is 9004.

Search

The field is not available for search.

name

name

The Entrust nShield HSM group name.

Type

String.

Values with leading or trailing white space are not valid for this field.

Create

The field is required on creation.

Search

The field is available for search via

• ‘:=’ (case insensitive search)
• ‘=’ (exact equality)
• ‘~=’ (regular expression)

Notes

The name is part of the base object.

pass_phrase

pass_phrase

The password phrase used to unlock the Entrust nShield HSM keystore.

Type

String.

Create

You must specify pass_phrase when protection is set to ‘SOFTCARD’.

Search

The field is not available for search.

Notes

pass_phrase is not readable.

protection

protection

The level of protection that the HSM group uses for the DNSSEC key data.

Type

String.

Valid values are:

• MODULE
• SOFTCARD

Create

The default value is MODULE.

Search

The field is not available for search.

status

status

The status of all Entrust nShield HSM devices in the group.

Type

String.

Valid values are:

• DOWN
• UP

Search

The field is not available for search.

Notes

The status cannot be updated.

status cannot be written.

Function Calls

refresh_hsm

This function is used to synchronize the HSM Entrust nShield configuration of HSM Entrust nShield devices.

This function does not support multiple object matches when called as part of an atomic insertion operation.

Input fields

None

Output fields

results ( String. Valid values are: “PASSED”, “INACTIVE”, “FAILED” ) The result of the HSM synchronization operation.

test_hsm_status

This function is used to test and verify HSM Entrust nShield functionallity (key pair request, predefined blob signing) via the utilities of the vendor.

This function does not support multiple object matches when called as part of an atomic insertion operation.

Input fields

None

Output fields

results ( String. Valid values are: “PASSED”, “INACTIVE”, “KEY_GEN”, “SIGNING” ) The result of the HSM status test operation.

Fields List

Field	Type	Req	R/O	Base	Search
card_name	String	Y*	N	N	N/A
comment	String	N	N	Y	: = ~
entrustnshield_hsm	[struct]	Y	N	N	N/A
key_server_ip	String	Y	N	Y	N/A
key_server_port	Unsigned int	N	N	N	N/A
name	String	Y	N	Y	: = ~
pass_phrase	String	Y*	N	N	N/A
protection	String	N	N	N	N/A
status	String	N	Y	N	N/A

* Required in some cases, see detailed field description above.