Manuals / Nortel Networks / Computer Equipment / Network Router

Nortel Networks NN46120-104 manual HSM Security Policy

Models: NN46120-104

1 300
Download 300 pages 2.66 Kb
Page 240
Image 240

240HSM Security Policy

when the SO invokes the Create User service. It is written to an iKey token through the trusted USB interface. Refer to following section 9.2 for a description of how this PIN is used for authentication.

Key-Wrapping-Key (KWK) = A 3DES3KEY key created by either the SO or User role for the purpose of wrapping private RSA keys. The Key-Wrapping-Key may be randomly generated using the Generate Key service, or may be entered into the module using the Combine Key service, which combines two key shares entered through the trusted USB interface. In the non-FIPS 140-1 mode, the Key-Wrapping-Key may also be created through the Derive Key service.

PRNG3DES Key (PRNGKey)= This 3DES2Key is used for seeding the X9.17 Pseudo-random Number Generator (PRNG). The PRNG 3DES Key is generated randomly using the hardware random number generator (RNG) within the FastMap processor. This key is generated every time

a random number is needed for key generation or as a direct request through the Generate Random Number service. The PRNG 3DES EDE Key is destroyed after each PRNG is generated.

RSA Public and Private Key Pair (SPK, VPK)= This RSA key pair is generated by either the SO or User role for the purpose generating RSA digital signatures through the RSA Sign service, or for verifying the same through the RSA Verify service. A key pair which is designated by the user who created it cannot be used for any other purpose such as key exchanges or encryption/decryption of data. The user may specify through Boolean attributes whether the private key may be used for Signature Generation and/or Data Decryption, and whether the public key may be used for Signature Verification and/or Data Encryption. Hence, a given key pair may be used for both signatures/verifications as well as data encryption/decryption. In FIPS 140-1 Mode, data encryption/decryption is not available.

RSA Encryption/Decryption Public and Private Key Pair (EPK, DPK)= This key pair is generated by either the SO or User role for the purpose of encrypting and decrypting data. When creating this key pair, the user may specify through Boolean attributes whether the private key may be used for Signature Generation and/or Data Decryption, and whether the public key may be used for Signature Verification and/or Data Encryption. Hence,

a given key pair may be used for both signatures/verifications as well as data encryption/decryption. Note that in the FIPS 140-1 Mode, although Encryption/Decryption key pairs may be generated, the RSA Encrypt and RSA Decrypt services are not available, and therefore, such keys are not usable in this mode.

Key-Wrapping-Key Share (KWKShare) = Key share obtained by splitting the KWK into two shares with the Split Key service. Two corresponding shares may be combined with the Combine Key service to enter the KWK into the module.

Nortel VPN Gateway

User Guide

NN46120-104 02.01 Standard

14 April 2008

Copyright © 2007-2008 Nortel Networks

Page 239 Page 241
Page 240
Image 240
Nortel Networks NN46120-104 manual HSM Security Policy
Page 239 Page 241

NN46120-104 specifications

Nortel Networks NN46120-104 is a versatile and efficient telecommunications hardware platform designed to meet the demands of modern networking environments. As a part of Nortel’s extensive portfolio, this device showcases the company’s commitment to innovation and reliability in the telecom sector.

One of the main features of the NN46120-104 is its robust performance capabilities. This platform is capable of handling high traffic volumes, making it suitable for medium to large enterprises. With its advanced routing capabilities and support for various protocols, the device ensures seamless communication across multiple network segments, providing efficient data transfer and connectivity.

The NN46120-104 is built upon the foundation of Nortel's renowned Layer 3 switching technology. This allows it to intelligently direct data packets based on their IP addresses, optimizing both speed and reliability. The inclusion of Virtual LAN (VLAN) support enhances network segmentation, improving security and management while reducing broadcast domains.

In terms of interface options, the NN46120-104 supports an array of Ethernet configurations, including Gigabit and Fast Ethernet ports. This flexibility allows organizations to tailor their networking solutions to their specific needs while enabling easy upgrades as technology evolves. The device also supports Power over Ethernet (PoE), facilitating the deployment of powered devices like IP phones and wireless access points without the need for additional power sources.

Another significant characteristic of the NN46120-104 is its robustness in terms of security features. With support for advanced security protocols and features such as Access Control Lists (ACLs), the device helps safeguard sensitive data by controlling traffic flow and restricting unauthorized access.

Additionally, the NN46120-104 is designed for ease of management. It offers an intuitive interface and supports various management protocols, including Simple Network Management Protocol (SNMP), enabling administrators to monitor and configure the device efficiently.

In summary, the Nortel Networks NN46120-104 combines high performance, extensive connectivity options, advanced security features, and ease of management, making it a formidable choice for enterprises looking to enhance their network infrastructure. Its capabilities align well with the rigorous demands of today’s digital communication landscape, ensuring reliability and efficiency in organizational operations.