Thales Data Protection on Demand now collects audit logs for Luna Cloud HSM Services using client version 10.2 and newer. Users can generate audit log files and retrieve signed URLs for access to the audit log files using the Audit Query API /v1/audit-log-exports endpoint. Audit logs provide a record of the outcome of an action by an actor on a resource. 

For more information about Audit Logging see About the Audit Log API. 

Additional Fields are now Mandatory for Tenant Registration

The following fields are now mandatory for tenant registration:

• Address
• City
• ZIP Code
• State/Province/Region*

* Mandatory if Country is set to United States, Canada, or Australia

Version 10.4.1 of the Luna HSM client is now available for download from the Thales Customer Support Portal.  This client supports hybrid usage of both Luna Cloud HSM services and the Luna HSM product line, as detailed in the Luna Cloud HSM Client User Guide.

• Download Luna HSM Client 10.4.1 for Windows
• Download Luna HSM Client 10.4.1 for Linux

Added

• Luna HSM Client 10.4.1 allows you to initialize a Luna Cloud HSM service using a domain secret imported from a red PED key. This allows you to clone objects between PED-authenticated Luna HSM partitions and Luna Cloud HSM enabling cloud backups and improving availability by adding Luna Cloud HSM to your HA groups. See Initializing a Luna Cloud HSM Service for more information.

Added

The Thales Luna Cloud HSM service is now available through Google Cloud Marketplace. Provisioning a Luna Cloud HSM service through Google Cloud Marketplace automatically generates a Thales Data Protection on Demand (DPoD) tenant and registers the user as the primary tenant administrator. The DPoD tenant provides access to features such as reporting and user and account management.

See the Thales Luna Cloud HSM service and Thales Data Protection on Demand documentation for more information.

Added:

Thales Data Protection on Demand can support requests to restore a Luna Cloud HSM Service partition to a previous state. 

Partition snapshots are taken daily and stored for 7 days. A tenant administrator can submit a partition snapshot restore request to have a partition restored to a previous state. Users can request restoration of a partition to recover from catastrophic events such as accidental zeroization of the service partition. Partition rollbacks can take up to 48 hours to complete.

Restoring a partition will undo any changes made to the service partition since the backup date, this includes removing new objects from the service partition and resetting password changes. 

Please download and complete the Partition Snapshot Restoration Request Form and include it in your support request to Thales Customer Support Portal. 

See the Partition Snapshot Restoration Guide for more information.

CipherTrust Key Broker for Google Cloud EKM service users can now access their DPoD platform tenant. Users can log in to their tenant hostname URL to access DPoD platform features such as User Management, Tenant Management, and Reporting.

CipherTrust Key Broker for Google Cloud EKM service tenants do not have access to tenant features such as Subscriber Groups or Adding Services.

Added

Data Protection on Demand sends an email alert on service creation. Tenant Administrators and Application Owners in the subscriber group where the service is created receive an email alert on service creation. 

Added

The Point to Point Encryption service is now available as a free Technology Preview.

Provision the service through your Thales DPoD tenant to access a Luna Cloud HSM and a set of utilities for secure storage and generation of Base Derivation Keys (BDKs) and Derived Keys. The service provides the HSM capabilities required to decrypt electronic payment transactions first encrypted by a point-of-sale terminal. Service keys can initialize point-of-sales terminals and decrypt data originating from point-of-sales terminals. 

See the P2PE Service Documentation for more information about downloading and configuring the service. 

Added

There is a new version of GemEngine available from the Thales Support Portal with the KB article number KB0024584. 

The purpose of the this toolkit is to allow HSMs to install a working version of SafeNet's OpenSSL dynamic engine to be integrated with OpenSSL. 

This allows Luna Cloud HSMs to be used for key storage and crypto operations through OpenSSL. 

The toolkit can be used for:

1. Installing pre-built dynamic engines to be plugged into existing OpenSSL installations for various OpenSSL streams (Linux only).
2. Compiling and installing the gem dynamic OpenSSL engine against existing or new OpenSSL installations.
3. Compiling and installing OpenSSL from source including optional FIPS mode support along with the gem dynamic OpenSSL engine.
4. Integrating OpenSSL with 3rd party applications such as OpenSSH effectively using the HSM for crypto operations and storing keys. 

The toolkit includes a script named gembuild to help achieve the above goals.