15.2.8.4 Deployment Scenarios

U-HSM and M-HSM servers are Windows based machines. HSM client applications, Job Manager, and FlashPro Express can be installed and run on either Linux® or Windows® systems.

On Windows platforms, client applications can be installed on the same or different physical operating systems. On Linux platforms, client applications are always installed on different systems.

There are two main HSM deployment scenarios: Server and Workstation.

For more information, see, the User HSM Installation and Setup User Guide and the Manufacturer HSM Installation and Setup User Guide .

15.2.8.4.1 Server

In the server deployment scenario, the HSM server runs on a dedicated PC. All client applications access HSM over the network.

One or more Job Manager applications can access the same U-HSM server at the same time, and one or more FlashPro Express applications can simultaneously use the same M-HSM.

Accessing HSM across the network requires certain ports to be open. For more information, see, the User HSM Installation and Setup User Guide and the Manufacturer HSM Installation and Setup User Guide .

15.2.8.4.2 Workstation

The workstation deployment scenario assumes client applications and HSM are sharing the same physical Windows system. Workstations in Operation or Production can be completely isolated from the network.

Note: U-HSM and M-HSM servers cannot be installed on the same physical Windows machine.

15.2.8.4.3 Notes about Using Virtual Machines

It is possible to run HSM (or client applications) inside virtual machines such as VMWare player. This provides the flexibility to create additional hybrid deployment scenarios. For example, Linux machine can run the Job Manager and VM with Windows system are installed for the U-HSM. This scenario enables the use of the same physical machine for both, client and server purposes. Such hybrid Workstation can be isolated from the external network.

Note: There are known issues related to using VMWare virtual systems. For information about workarounds proposed by Thales, see the nShield Edge Solo User Guide.