Changed

• Enforcing restriction of 100 token objects (or 50 RSA-2048 key pairs) per service. We recommend you remove any unused keys to comply with the 100 token object limit and improve HSM performance.

Added

• Added the Key Broker for Azure Key Management on Demand service tile to the DPoD platform. The Key Broker for Azure service generates high-entropy keys and securely imports them into the user's Microsoft Azure Key Vault where the keys can be used to enhance data protection and compliance.

Added

• Tenant Administrator users can now use HSM on Demand services.

Deprecated

• Removing support for the DPoD API endpoint /services in the next release. We recommend you begin using the /service_instances endpoint for all related HSMoD service client operations. 

Bugs Found

• DPS-2808: When the Service Provider deletes a Tenant, if the deletion fails the Tenant Details page is not accessible. Workaround: This issue results from attempting to delete a Tenant with active services. To clear this state you must remove the blocking service from the Tenant's Application Owner users.
• HOD-957: There is no user feedback in the lunacm utility on connection timeout. As a result, the client can appear to hang indefinitely. Workaround: Wait for the client to timeout or close and restart lunacm to re-attempt the connection.
• KBR-620: The Salesforce Key Broker service is not available over the API. Workaround: Use a DPoD Application Owner account to configure a Salesforce Key broker service.
• DPS-2161: Services with extended ascii characters in their name do not display properly in reports. Workaround: Open the report in a spreadsheet program with UTF-8 encoding.

Bugs Fixed

• DPS-3083: The DPoD API endpoint /service_instances succeeds on the bind HSMoD service client operation.
• DPS-2614: Tenant names are now trimmed on creation.
• DPS-2494: Non-functional tenants that appear in the "Pending" state in the user interface are no longer included in reports.

Changed

• The DPoD Platform Customer Release Notes (CRN) has been removed from distribution. Please refer to the Platform Changelog to stay up-to-date on the DPoD platform and its available services.
• Please refer to the Universal Client Customer Release Notes (CRN) for more information about the Universal Client used by HSM on Demand services. 

Bugs Fixed

• SH-5169 - Resolved an issue where clients with a very high session version could fail when connecting to the service.

Added

• Firmware for FIPS and non-FIPS services has been upgraded to version 1.4. Firmware version 1.4 enables future platform functionality.
• Firmware version 1.4 is FIPS 140-2 Level 3 validated - The SafeNet Cyptovisor K7 Cryptographic Module used in the SafeNet Data Protection on Demand service is FIPS 140-2 Level 3 validated. For more information see the NIST Certificate #3519.

Added

• SafeNet Data Protection on Demand now includes a Luna HSM Backup service. The Luna HSM Backup is an HSM on Demand (HSMoD) service offering that provides a dedicated backup and restore location for your organization's on-premises Luna HSMs. For more information about the Luna HSM Backup service see the section Luna HSM Backup. 
• SafeNet Data Protection on Demand now inclues a Key Broker for Azure service. The Key Broker for Azure Service is a Key Management on Demand service offering that generates high-entropy keys and securely imports them into the user's Microsoft Azure Key Vault where the keys can be used to enhance data protection and compliance, for example using Azure Information Protection to encrypt Office 365 documents. For more information about the Key Broker for Azure Service see the section Key Broker for Azure Service.

Added

• SafeNet Data Protection on Demand now contains Partner Service Tiles. Partner service tiles redirect the user to an affiliated service site where users can register for a DPoD partner's service offering. For more information about Partner services see the Partner Services Documentation.
• Version 10.1 of the HSMoD service client is now available for download from SafeNet Data Protection on Demand. This client supports hybrid usage of both HSMoD services and the SafeNet Luna Product Line, as detailed in the HSM on Demand Client User Guide. These features include:
  • Secure key cloning between HSMoD Services and password-authenticated SafeNet Luna Network HSM 7.x or SafeNet Luna PCIe HSM 7.x.
  • Failover between HSMoD Services and password authenticated SafeNet Luna Network HSM 7.x or SafeNet Luna PCIe HSM 7.x. This feature is configured using LunaCM's high availability (ha and hagroup) commands. We recommend the default setting of the HSMoD service as a standby member of the HA group.
  • Key backup and restore with the password-authenticated SafeNet Luna G5 Backup HSM.

Bugs Fixed

• SH-4350 - Utilities included in older clients downloaded before October 2019 can have a delay of up to 20 seconds on startup. Resolution: Clients that contain this bug are no longer supported or available for download.
• SH-3519 - The LunaProvider.jar does not allow generation of FIPS 186-3-approved RSA keys. Resolution: The LunaProvider.jar included in the latest client package includes this support.
• LUNA-10915, SH-3162 - When you delete a key from the an HSMoD service, CKlog displays an incorrect object handle. Resolution: Fixed in the latest client package.

Added

• Users can now reset their password for the SafeNet Data Protection on Demand log in page without requiring administrator intervention. In the event of MFA lockout, users are still required to contact their administrator to reset the token.
• HSM on Demand Services running in Non-FIPS mode now support BIP32. There are now two BIP32 mechanisms available: CKM_BIP32_CHILD_DERIVE and CKM_BIP32_MASTER_DERIVE. In addition, ECDSA mechanisms now accept BIP32 key types for the key derivation function. The latest client version (10.0 or above) is required for these mechanisms. Clients downloaded before October 2019 do not support BIP32.
• HSM on Demand Services now fully support the 22519 elliptic curve variant.

Bugs Fixed

• SH-4240 - If you initialize the Crypto User, and then login and logout of this role without changing its password, the LunaCM session can no longer log in or log out any users, and returns the error CKR_USER_ALREADY_LOGGED_IN.
• SH-3804 - A multi-part command fails with the error CKR_OPERATION_NOT_INITIALIZED.
• KBR-758 - After Tenant creation, the new Tenant is not visible in the Tenants list.

Added

• Achieved FIPS 140-2 Level 3 certification. See Customer Release Notes 1.11 for more information.
• NoIndex added to enterprise tenant marketplaces, eliminating enterprise tenant URLs from appearing in Search results. See Customer Release Notes 1.11 for more information.

Changed

• Updated HSMoD service client. All users are required to upgrade their client as soon as possible, as the previously available client contains certificates that expire on December 31, 2019. Certificates or key material stored on the HSMoD service will still be available following the upgrade. See Upgrading your HSMoD Service Client.
• ms2Luna does note work in FIPS mode. See Customer Release Notes 1.11 for more information.
• Updates to supported Cryptographic API's. See Luna Cloud HSM Service Supported Client Platforms for the list of supported Cryptographic API's.
• Various UI enhancements and improvements.

Deprecated

• HSMoD service client v1.1.x. This version of the client will not connect to HSMoD services beyond Dec 31, 2019.
• Utilities included in older HSMoD service clients downloaded before October 2019 can have a delay of up to 20 seconds on start up. We recommend you install the latest service client. See Upgrading your HSMoD Service Client for more information.

Features under development

• FIPS Certification Firmware Candidate - The HSM firmware is undergoing FIPS certification coordination.

Added

• Added the Virtual Token Library (VTL) to the 1.10 HSMoD service client. 
• Client patched reducing timeout and failover issues during key and certificate migration.
• Direct link to SafeNet Data Protection on Demand **Status Page** available in user interface footer.
• The Company name no longer needs to be unique. Now, multiple enterprise tenants can share a common company name.
• Service provider monthly reports now include the minimum billable units (MBU) selection from the tenants **Initial Elections** form.

Deprecated

• Deprecating support for 32-bit operating systems.
• Ending support for Windows Server 2008 and Windows Server 2008 R2.

Removed

• You cannot download a new HSMoD service client for a service which existed prior to release 1.5. Recreate the service.

Bugs Fixed

• DPS-3071 - Deleting an application owner account before deleting any associated platform credentials results in being unable to delete both the platform credentials and any associated subscriber group.
• DPS-3006 - The HSM on Demand service generic mapping refers to key_vault in reports and the API.