Skip to main content
For this step, you must log in with an identity that has a role with the following permissions: Role:Add, Role:Assign All Permissions, Role:Modify, Keys:All Slots, and Command Settings:Excrypt. You can use the default Administrator role and Admin identities.
This integration guide treats the terms application partition and role as synonymous.
Before logging in to the HSM with an authenticated user, an application connects through a transaction processing connection to the transaction processing application partition. Configure the following items to harden this partition:
  • It should not have access to the All Slots permissions.
  • It should not have access to any key slots.
  • Enable only the PKCS #11 communication commands in the following list. Don’t enable key operation commands such as ASYS; the library runs them only after login, under the application partition.
Choose one of the following methods to configure the transaction processing connection:

​
Excrypt Manager

Perform the following steps to configure a transaction processing connection in Excrypt Manager:
1
Go to the Application Partitions menu, select the transaction processing application partition, and select [ Modify ].
2
In the Permissions tab, leave the top-level Keys permission checked and clear the All Slots sub-permission.
3
In the Key Slots tab, ensure that the settings do not specify key ranges. By default, the transaction processing application partition can access the entire range of key slots on the HSM.
4
In the Commands tab, enable only the following PKCS #11 communication commands:
CommandDescription
ECHOCommunication test / retrieve version
GPKMRetrieve key table information
GPKRGeneral-purpose key settings get (read-only)
GPKSGeneral-purpose key settings get/change
HASHRetrieve device serial
PRMDRetrieve HSM permissions
RANDGenerate random data
STATHSM statistics
TIMEGet or set time. The Futurex PKCS #11 library reads the HSM time before login.

​
FXCLI

Run the following role modify FXCLI commands to remove all permissions and key ranges that are currently assigned to the Transaction Processing role and enable only the PKCS #11 Communication commands:
Because the Transaction Processing role was previously called the Anonymous role, the following commands specify Anonymous in the name field.
FXCLI
FXCLI