Connect HSM 7000 to rp5470 (GSP)

[KPADENOU]

We have a serveur rp5470 with a core I/O card and we want to connect to the server a HSM (Host Security Module). My question is, can we use GSP RS-232 to connect the HSM (note that the HSM accept DB25 male - male cable).

Another question is Can we connect a device like printer on GSP RS-232?

[KPADENOU]

Nobody has an approach of solution

[Matti_Kurkela]

I don't know what you mean with HSM, but after a quick Google search I'm going to assume it's some sort of a box which handles the security operations for credit card transactions (or credit card creation). Am I right?

Since we are talking about rp5470, I assume we are talking about something that requires significantly more performance than a single POS terminal - right?

I haven't needed the GSP RS-232 ports for anything other than the console terminal, but I don't see why it should not work. (Oops. I just realized: if the HSM outputs a Control-B character at any time, the protocol between the HSM and the software in the server might get confused unless the GSP functionality can be disabled somehow...)

As far as I know, the 9-pin port has the same pin assignment as any normal PC has, so finding the necessary adapter for DB25 cable should not be too difficult.

You don't want to connect the HSM to the "console" port, since it would make server maintenance rather difficult. So, that leaves us the "UPS" and "remote" ports.

The UPS port would limit your communication speed with the HSM to 1200 bps, which would be quite a performance bottleneck. So the "remote" port is really the only choice.

Furthermore, you would want to ensure your server has a Revision B GSP: the older Revision A has a speed limit of 19200 bps on "remote" and "console" ports. Revision B can go up to 38400 bps. See http://docs.hp.com/hpux/onlinedocs/A5191-96022/00/00/18-con.html for more information about GSP revisions.

The device filename to use would be /dev/tty0p - probably /dev/tty0p1. I've never had the opportunity to use the GSP's "remote" connection for anything, so I don't really know.

[KPADENOU]

Hi,
I thanks Matti Kurkela for his answers.
You are rigth about the HSM.

I re-ask my question. Can i use the DB25 connector on GSP card to connect divice (like HSM) to the rp5470 server?

or in other word, Can I use DB25 connector on GSP card for other purpose.

thanks.

[Matti_Kurkela]

Because the GSP card's DB25 connector has 3 different RS232 interfaces wired in, it obviously has some non-standard connections.

I would definitely NOT connect anything other than the standard GSP 3-way cable directly to it: I might short-circuit something. Besides, removing the 3-way cable and plugging something directly into GSP's DB25 connector makes the use of the administrator console rather hard.

If HP's engineers have been smart here, I would think that one of the GSP's serial interfaces is wired to the RS232 standard locations in the DB25 connector. If so, I would be almost willing to bet that the interface that's built to be usable without the 3-way cable would be the "console" interface - and I already told why using that would be more trouble than it's worth.

However, connecting a standard DB9-to-DB25 RS232 adapter into the "Remote" DB9 of the 3-way cable should not be a problem. You could find one from the nearest computer shop that sells PC hardware.

In another thread, someone recommended leaving the GSP's serial ports strictly for administrative use and installing a "multiplexer card" for production RS232 data transfers. They might be slightly overkill in your case, because you said you only need one port. See http://docs.hp.com/hpux/onlinedocs/5966-8703/00/00/6-con.html for more info.

On the other hand, the multiplexer cards can reach way better speeds on the RS232 than the GSP. The smaller multiplexer card, J3592A, has 8 ports and the maximum speed per port is 230,400 bps - a lot more than 38400 bps which is the GSP's maximum. If you need the full performance of the HSM, you might need something like this anyway.

If you decide to use the J3592A, you'll need another kind of adapter: from RJ-45 to the HSM connector. This might be a bit harder to find, but it shouldn't be expensive. No electronics is required, just a block of plastics and metal that will route the wires in the proper locations.

RS232 is an old technology, which has been used with many kinds of connectors. I've heard that in the 1980s the ability to build RS232 cables and adapters was at some considered a necessary skill for a system administrator.

Do you have the specifications for HSM? How fast it can transfer data through the RS232?

[KPADENOU]

hi,

The Host baud is changed from 300 to 19200 bps; the word format to 8 data bits, no parity and 1 stop bit.

thanks.

[KPADENOU]

I would be happy if you can give me the way to configure the equipment (HSM) on the GSP connector.

thanx.

[Matti_Kurkela]

As I said before, I haven't actually used the GSP "remote" RS232 for anything yet. However, the following is my best guess. It is an adaptation from HP's document KBRC00011494, which contains instructions for connecting a modem to the GSP. I found it with a Google search in some mailing list archive.

1. Connect the standard HP 3-way cable to the GSP's DB25 connector.

2. Connect console terminal to the "console" end of the 3-way cable. (you will need it soon)

3. connect HSM to the "remote" end of the 3-way cable, either using a 9-to-25-pin null modem cable OR 25-pin to 25-pin null modem cable and an 9-to-25-pin adapter at the server end. (The null modem cable will work unless the HSM connector has a special pin-out).

4. Press Ctrl-B on console terminal to access the GSP.

5. Type the GSP command "CA" and set the Remote Console port bit rate and flow control as appropriate for the HSM.

6. Type the GSP command "ER" and ensure that the GSP remote port is in "Session" mode, (so that the GSP won't block the server's access to the HSM)

7. Exit the GSP (type "CO" command). Login to the server as root. Check that device files aren't already there:
ll /dev/*0p2
There should be only one: /dev/tty0p2.

8. Create the callin and callout devices for the GSP "remote" interface (this is what could be done with SAM if we would be actually installing a modem).
mknod /dev/cua0p2 c 1 0x000201
mknod /dev/ttyd0p2 c 1 0x000202

9. Ensure that the device nodes are properly configured.
lssf /dev/*0p2
The response should be:
asio0 card instance 0 port 2 callout at address 0/0/4/0 /dev/cua0p2
asio0 card instance 0 port 2 hardwired at address 0/0/4/0 /dev/tty0p2
asio0 card instance 0 port 2 callin at address 0/0/4/0 /dev/ttyd0p2

10. Try to access the HSM, somehow. If the protocol is "human-readable", you could try using "cu" or some other terminal emulator program. If HSM's protocol is in binary form, you must use a program that knows the protocol. HSM's own diagnostic software would be ideal, if there is such a thing.

Which one of the three possible devices you should be using? Well, I must say I don't know that. The "hardwired" default device /dev/tty0p2 might be a good starting point,
and if it does not work, try "callout" device /dev/cua0p2. NOTE: this is just my wild guess at this point.

You may have to adjust the serial port driver's settings with stty. For example, to set (the driver's idea about) the speed of the serial port to 19200, use a command like
stty 19200
Yes, the "<" is not obvious. However, the reason why it works this way is rooted deep in the history of unixlike operating systems.

[KPADENOU]

Hi,
thanks for Matti Kurkela.

[malvin drakley]

Hi can I just add my 2 pence worth. If you have a standard HP rs232 cable (the one labelled 24542G) it can be connected to the core i/o on the L box and there are enough connections to get an HP 700/96 terminal working on the 9 pin port, so it may be possible to connect your HSM. That means that you will have to go into your console over the lan connections though.
cheers
malvin