hsm:thalesgroup : The Thales Harware Security Module group object.

Deprecated. You need to use Entrust nShield object instead. You can integrate a Grid with a third-party, network-attached Hardware Security Modules (HSMs) for secure private key storage and generation, and zone-signing offloading. Infoblox appliances support integration with either SafeNet HSMs or Thales HSMs. When using a network-attached HSM, you can provide tight physical access control, allowing only selected security personnel to physically access the HSM that stores the DNSSEC keys.

The Thales Hardware Security Module (HSM) group represents the collection of Thales HSM devices that are used for private key storage and generation.

Note that you can create one Thales HSM group in the Grid.

Object Reference

References to hsm:thalesgroup are object references.

The name part of the Theales HSM object reference has the following components:

• The Thales HSM group name

Example:

hsm:thalesgroup/ ZG5zLm9wdGlvbl9kZWZpbml0aW9uJGluZm8uLmZhbHNlLjI1Mg:group1

Restrictions

The object does not support the following operations:

• Global search (searches via the search object)
• Scheduling
• CSV export

The object cannot be managed on Cloud Platform members.

Fields

These fields are actual members of the object; thus, they can be requested by using _return_fields, if the fields are readable.

The basic version of the object contains the field(s): comment, key_server_ip, name.

The following fields are required to create this object:

Field	Notes
card_name	See the field description for more information
key_server_ip
name
pass_phrase	See the field description for more information
thales_hsm

card_name

card_name

The Thales HSM softcard name.

Type

String.

Create

You must specify card_name when protection is set to ‘SOFTCARD’.

Search

The field is not available for search.

comment

comment

The Thales HSM group comment.

Type

String.

Create

The default value is empty.

Search

The field is available for search via

• ‘:=’ (case insensitive search)
• ‘=’ (exact equality)
• ‘~=’ (regular expression)

Notes

The comment is part of the base object.

key_server_ip

key_server_ip

The remote file server (RFS) IPv4 Address.

Type

String.

Create

The field is required on creation.

Search

The field is not available for search.

Notes

The key_server_ip is part of the base object.

key_server_port

key_server_port

The remote file server (RFS) port.

Type

Unsigned integer.

Create

The default value is 9004.

Search

The field is not available for search.

name

name

The Thales HSM group name.

Type

String.

Values with leading or trailing white space are not valid for this field.

Create

The field is required on creation.

Search

The field is available for search via

• ‘:=’ (case insensitive search)
• ‘=’ (exact equality)
• ‘~=’ (regular expression)

Notes

The name is part of the base object.

pass_phrase

pass_phrase

The password phrase used to unlock the Thales HSM keystore.

Type

String.

Create

You must specify pass_phrase when protection is set to ‘SOFTCARD’.

Search

The field is not available for search.

Notes

pass_phrase is not readable.

protection

protection

The level of protection that the HSM group uses for the DNSSEC key data.

Type

String.

Valid values are:

• MODULE
• SOFTCARD

Create

The default value is MODULE.

Search

The field is not available for search.

status

status

The status of all Thales HSM devices in the group.

Type

String.

Valid values are:

• DOWN
• UP

Search

The field is not available for search.

Notes

The status cannot be updated.

status cannot be written.

thales_hsm

thales_hsm

The list of Thales HSM devices.

Type

A/An Thales Hardware Security Module struct array.

Create

The field is required on creation.

Search

The field is not available for search.

Function Calls

refresh_hsm

This function is used to synchronize the HSM Thales configuration of HSM Thales devices.

This function does not support multiple object matches when called as part of an atomic insertion operation.

Input fields

None

Output fields

results ( String. Valid values are: “PASSED”, “INACTIVE”, “FAILED” ) The result of the HSM synchronization operation.

test_hsm_status

This function is used to test and verify HSM Thales functionallity (key pair request, predefined blob signing) via the utilities of the vendor.

This function does not support multiple object matches when called as part of an atomic insertion operation.

Input fields

None

Output fields

results ( String. Valid values are: “PASSED”, “INACTIVE”, “KEY_GEN”, “SIGNING” ) The result of the HSM status test operation.

Fields List

Field	Type	Req	R/O	Base	Search
card_name	String	Y*	N	N	N/A
comment	String	N	N	Y	: = ~
key_server_ip	String	Y	N	Y	N/A
key_server_port	Unsigned int	N	N	N	N/A
name	String	Y	N	Y	: = ~
pass_phrase	String	Y*	N	N	N/A
protection	String	N	N	N	N/A
status	String	N	Y	N	N/A
thales_hsm	[struct]	Y	N	N	N/A

* Required in some cases, see detailed field description above.