Partition Authorization

Allows state changes in partitions configured for M of N authentication.

The state of partitions can be changed to associate them with a set of cards and to authorize an already associated partition.

Cryptographic keys can be created while the partition is in an unauthorized state and can be effectively used once authorization is granted.

After specifying the partition ID (which is the same as the user ID), a screen will display the partition's current state, currently configured permissions, and options to make state changes.

The actions possible with the partition keys are defined according to the permissions enabled and the status. For example, the Key Export permission may be enabled, but an (exportable) partition key can only be exported when it is in Authorized status. The table below shows the possible actions depending on the status and permissions.

To change the state, the set of cards from the M of N set must be presented, and the partition's password credential must be provided.

Info

If the HSM is part of a Replication Domain, the state change in the partition will be replicated to the other nodes.

As of firmware version 5.3.0.0, it is possible to change state online, using one of the HSM consoles or via API. The user's workstation must have the HSM client software installed and a certified smart card reader plugged in (see Remote Management), as well as the presence of the partition card custodians. In remote operation there is a unique state for the specific session in which the user is connected to the HSM: Session Authorized. A change to this state is not reflected in the other sessions or in the local state of the partition in the HSM. The Authorized state can be set online if the corresponding policy is enabled.

The service must be running during the state change.

The possible permissions for the partition are:

1. Key Read: implicit, cannot be changed;
2. Key Export: allows the export of keys, provided they have the exportable attribute;
3. Key Destroy: allows keys to be destroyed;
4. Key Block: allows keys to be blocked, preventing their use even when authorized;
5. Partition Remove: allows the complete removal of the partition and destruction of all keys contained therein, and includes the Key Destroy permission;

Permitted and authorized actions for keys are executed via API or remote console.

The figure below illustrates the state transitions.

---
title: Transições de estado na autorização de partições via API
---

%%{ init: { 'flowchart': { 'curve': 'basis' } } }%%

stateDiagram-v2
    state "Initial" as initial
    state "Associated" as associated
        note left of associated
             Set Permissions
        end note
    state "Authorized" as authorized
        note left of authorized
             Set Permissions
        end note
        note right of authorized
            Set online if Policy
        end note
    state "Session Authorized" as e_auth
        note left of e_auth
             Online only
        end note


    classDef KeyUsage fill:darkgreen
    classDef KeyBlocked fill:darkred
    classDef movement font-style:italic
    classDef badBadEvent fill:#f00,color:white,font-weight:bold,stroke-width:2px,stroke:yellow

    %% the trailing spaces are needed, do dot delete them.
    initial --> associated: 
    associated --> authorized: 
    %%associated  --> associated: Set permissions
    associated --> initial: reset
    associated --> e_auth: 
    authorized --> initial: reset 
    %%authorized --> authorized: Set permissions
    authorized --> associated: 
    authorized --> e_auth: 
    e_auth --> associated: 
    e_auth --> authorized:  
    e_auth --> initial: reset

    class e_auth KeyUsage
    class authorized KeyUsage
    class initial KeyBlocked
    class associated KeyBlocked

The table below shows the possible actions and the necessary conditions (state and permissions) for them to be executed successfully.

Warning

The state of the partition is maintained between reboots of the HSM.

Action	Partition State	Required Permission Enabled
Key Generation	Initial or Associated	-
Key Blocking	Associated	Key Block
Key Destruction	Associated	Key Destroy
Complete Partition Removal	Associated	Partition Remove (destroy all keys)
Key Exportation	Authorized	Key Export
Key Usage (encryption)	Authorized	-

                        Dinamo - Local Management Console


              ┌───────────────────┤ nsauth ├────────────────────┐
              │                                                 │
              │                                                 │
              │     State: Initial                              │
              │                                                 │
              │     [ ] - Key Read                              │
              │     [ ] - Key Export                            │
              │     [ ] - Key Destroy                           │
              │     [ ] - Key Block                             │
              │     [ ] - Partition Remove (destroy all keys)   │
              │                                                 │
              │                                                 │
              │   ┌─────────────┐  ┌─────────────┐  ┌───────┐   │
              │   │  Associate  │  │  Authorize  │  │ Close │   │
              │   └─────────────┘  └─────────────┘  └───────┘   │
              │                                                 │
              └─────────────────────────────────────────────────┘




  Service running...                                Replication Domain: <none>

Partition State and Permissions