Business Processes

In the navigation menu, select the menu item "Accounts" → “Manage user accounts”.

Click on "Create user account" in the list of KMS-Tenant users (see step 1) and confirm the action.

A second Tenant operator logs into the KMS-Tenant to give his vote for the proposal (dual order principle);

In the list of proposals (menu item “Proposals”), select the proposal by clicking the appropriate button “Details”;

Check the displayed information and click on "+ Vote";

If the required number of votes has been reached, click "complete proposal" to create the Tenant user account;

The password is generated and offered in a form. To make the password visible, the corresponding field must be clicked. The password can also be saved to the clipboard by clicking the "Copy" button.

{
   "component": "KMS-Tenant",
   "users": [
       {
           "username": "……",
           "password": "……"
       }
   ]
}

Select menu item "Accounts" → “Edit account” in the navigation menu;

Edit "Username" or “E-Mail” and click “Save”.

In the navigation menu, select menu item "Account" → “Change password”;

Enter the new password and repeat your choice;

Click on “Submit” to change your password.

Click the appropriate "Edit"-Button in the list of KMS-Tenant users (see step 1);

Click “reset” to reset the account.

Select menu item "Accounts" → “Manage user accounts” in the navigation menu;

In the list of KMS-Tenant user accounts select the account by clicking the appropriate “Edit” button;

Check the displayed information and click “Delete”. The action must be confirmed. Since the deletion of an user account is based on the principle of dual control, only a deletion proposal has been created. This proposal must be confirmed (voted) by a second operator.

A second Tenant operator log into the KMS-Tenant to give his vote for the proposal (dual order principle);

In the list of proposals (menu item “Proposals”), select the proposal by clicking the appropriate “Details” button.

Check the displayed information and click an "+ Vote";

If the required number of votes has been reached, click "Complete proposal" to delete the Tenant user account.

Select menu item "Setup" → "Manage KEKS" in the navigation menu.

Select menu item "Setup" → “Create KEKS" in the navigation menu (or click “Create” in the list of KEKS, see step 01);

Enter a name for the KEK;

Click on “Select” and select the intended HSM-Profile from the list;

Click on “Create” to create a proposal for the KEK.

Log into the KMS-Tenant as second administrator to give the missing vote;

Select “Proposals” in the navigation menu;

Click the appropriate “Edit” button to select the proposal;

Click “+ Vote”;

If the required number of votes for the proposal is reached, click “Send proposal” to generate the KEK finally.

Click appropriate "Details" button in the list of KEKS (see step 01);

Click on "Activate" and confirm the action.

Click the appropriate "Details" in the list of KEK (see step 01);

Click on "Delete" and confirm the action;

Log into the KMS-Tenant as second administrator;

Select the deletion proposal via menu item "Proposals" in the navigation menu and give the second vote. The process is described in detail in chapter P-KMS-TNT-03 – KMS Clients (create, modify, delete).

Select menu item "Setup" → "Manage KEKS" in the navigation menu.

Select menu item "Setup" → “Create KEK (protected)" in the navigation menu (or click “Create KEK (protected)” in the list of KEKS, see step 01);

Enter a name for the KEK;

Click on “Select” and select the intended HSM-Profile from the list;

Click on “Create” to create a proposal for the KEK.

Log into the KMS-Tenant as second administrator to give the missing vote;

Select “Proposals” in the navigation menu;

Click the appropriate “Edit” button to select the proposal;

Click “+ Vote”;

If the required number of votes for the proposal is reached, click “Send proposal” to generate the KEK finally.

Click appropriate "Details" button in the list of KEKS (see step 01);

Click on "Activate" and confirm the action.

Click the appropriate "Details" in the list of KEK (see step 01);

Click on "Add HSM-Profile";

Click on “Select” and select the intended HSM-Profile from the list (Note: you cannot use the same HSM-Profile twice for the same protected KEK);

Click on “Add”.

Log into the KMS-Tenant as second administrator;

Select the “Add HSM-Profile” proposal via menu item "System" → "Available proposals" in the navigation menu and give the second vote. The process is described in detail in chapter P-KMS-TNT-03 – KMS Clients (create, modify, delete).

Click the appropriate "Details" in the list of KEK (see step 01);

Click on "Remove" next to the desired HSM-Profile and confirm the action;

Log into the KMS-Tenant as second administrator;

Select the removal proposal via menu item "System" → "Available proposals" in the navigation menu and give the second vote. The process is described in detail in chapter P-KMS-TNT-03 – KMS Clients (create, modify, delete).

Click the appropriate "Details" in the list of KEK (see step 01);

Enter the backup string inside the “Backup string” input field;

Click on “Select” and select the intended HSM-Profile from the list;

Click on “Create from backup”.

Click the appropriate "Details" in the list of KEK (see step 01);

Click on "Delete" and confirm the action;

Select menu item "Setup" → "Manage KMS-Clients" in the navigation menu.

Click on "Create Credentials" in the list of KMS-Clients (see step 1) and confirm the action.

Safely store access data for the new KMS-Client:

{
   "component": “KMS-API",
   "category": “kms-clients",
   "credentials": {
       "username": "…",
       "password": "…"
   }
}

Click on "Edit" in the list of KMS-Clients (see step 1) to select the client to be modified;

Edit "Description" attribute;

Click on "Save".

Click on "Edit" in the list KMS-Clients (see step 1) to select the client to be deleted;

Click on "Delete Credentials" and confirm.

Select menu item "Proposals" in the navigation menu.

In the list of account proposals, click on “Details” for the proposal that should be voted for;

Check the displayed data;

Click on "+ Vote";

In the list of account proposals, click on “Details” for the proposal that should be completed;

Click on “Complete proposal”;

The password is generated and offered in a response page. To make the password visible, the corresponding field must be clicked. The password can also be saved to the clipboard by clicking the "Copy" button. With the creation of the admin and the corresponding password the process is finished. The access data generated must be handed over to the responsible person in a secure manner.

In the list of account proposals, click on “Details” for the proposal that should be deleted;

Click on “Delete Proposal” and confirm. The proposal is now deleted and no longer appears in a list of proposals;

In the list of KEK proposals, click on “Edit” for the proposal that should be voted for;

Check the displayed data;

Click on "+ Vote";

In the list of account proposals, click on “Details” for the proposal that should be deleted;

Click on “Delete Proposal” and confirm;

In the list of KEK proposals, click on “Details” for the proposal that should be completed;

Click on “Complete proposal”;

The KEK has been created. Optional: Click on “Activate” to activate the KEK.

Go to on “Setup” → “Manage KMS clients”;

Click on “Edit” for the appropriate client;

Click on the checkbox for “ Client-Auth using certificate”;

Click in “Generate certificate”

Click on “Download .p12” to save your PKCS#12 keystore file.

Save the appropriate password.

Click on “Download .pem” to download your certificate.

Go to “Setup” → “Manage Application Namespaces”;

Click on “Create Application Namespace”;

Insert the “Namespace” (mandatory field) and the “Data”;

Click on “Create” to generate the Application Namespace.

Go to “Setup” → “Manage Application Namespaces”;

Click on “Edit” for the appropriate Application Namespace;

Insert a new value for “Data”;

Click on “Save”;

Go to “Setup” → “Manage Application Namespaces”;

Click on “Edit” for the appropriate Application Namespace;

Click on “Delete Application Namespace”.

For each legacy cryptotoken on the page, enter its key share (as provided to you by the KMS-Admin) by entering it in the respective input field and clicking on the "+ Add share" button.

If you suspect you have entered the wrong key share (or a key share associated with another cryptotoken) you can click on "Remove share" and enter a new one.

Repeat this process with different KMS-Tenant operators (that have different key shares) until enough key shares have been gathered.

Click on “Migrate legacy cryptotoken”. The gathered key shares will be used to migrate the cryptotoken to an HSM-Profile.

Repeat this process for all legacy cryptotokens.

When all legacy cryptotokens were successfully migrated, click on "Proceed" to access the application.