Trusted Key Entry (TKE)

Edit online
The 9176 may have one or more of the following Crypto Express features for applications where extensive data security is required.
  • FC 0908 or FC 0909: Crypto Express8S
  • FC 0898 or FC 0899: Crypto Express7S
For these systems, there is a separate console available for authorized access to the Crypto feature specified. This console is named the Trusted Key Entry (TKE) workstation.
Notes:
  • TKE 10.1 (FC 0883) is the most current version of TKE.
  • The TKE does not check the IBM Z or LinuxONE processor level. It is the version of the newest HSM on your 9176 that determines what level of TKE you must have. Use this chart to determine the level of TKE you need to manage the HSMs on your 9176:
    • TKE 10.0 is the minimum level of TKE needed to manage a crypto express 8 HSM
    • TKE 9.0 is the minimum level of TKE needed to manage a crypto express 7 HSM
    It is always best to be at the most current level of TKE because it can manage any level of HSM.
 
The supported Trusted Key Entry (TKE) features are as follows:
  • The following table top or tower TKE workstations include a system unit, flat panel display, mouse, keyboard, and line cord.
    • FC 0058: TKE 2461-TW4
    • FC 0088: TKE 2461-TW3 (carry forward only)
    Note: IBM z17 Single Frame (Model ME2) is the last machine family where the table top or tower hardware server form factor of the Trusted Key Entry (TKE) will be supported. The 1U TKE is available on IBM z17 Single Frame (Model ME2), and the 1U TKE will be the only supported hardware in the future. For console room use of the 1U TKE, IBM recommends that there is consideration to mount the 1U TKEs in a mini racks with acoustical noise protection.
  • The following rack-mounted TKE workstations include a system unit and a 1U console unit that holds the flat panel display and the keyboard.
    • FC 0057: TKE 2461-SE4
    • FC 0087: TKE 2461-SE3 (carry forward only)
  • Optional TKE Tabletop KMM (keyboard, monitor, mouse) - FC 0157
  • Optional 1U TKE Rack Mount KMM (keyboard, monitor, mouse) - FC 0156
Attention: FC 0087 and FC 0088 can only be carried forward; however, to use with the 9176, they must be converted by replacing the installed Crypto adapter card with a 4770 TKE Crypto adapter card (FC 0851).

The built-in Ethernet adapter supports a link data rate of 10, 100, or 1000 Mbps. The built-in Ethernet adapter supports a link data rate of 10, 100, or 1000 Mbps.

The TKE workstation attaches to the customer LAN, providing a security-rich, flexible method of providing master key and operational key entry to locally and remotely managed Cryptographic Coprocessor features.

TKE with optional Smart Card Reader (FC 0891), allows access to and use of confidential data on the Smart Card, protected by a user defined personal identification number (PIN) code providing secure storage, access, transport and entry of master and operational key parts into the TKE workstation. The following characteristics pertain to the Smart Card Reader:

  • The Smart Card Reader is an optional security device that attaches to the TKE.
    • FC 0891 contains two Smart Card Readers, two serial port Y adapters, two serial cables, and 20 blank smart cards. The cables provide both power source for the Smart Card Reader and the communication path between the Smart Card Reader and the TKE workstation.
    • FC 0892 or FC 0900 provide the ability to order additional blank Smart Cards. The Smart Card Reader is a corequisite for ordering additional Smart Cards.
  • TKE logon profiles can be placed on smart cards, which provide enhanced control over the sign on processes.
  • A TKE workstation and the TKE 7.2 or later level code are co-requisites for ordering the Smart Card Reader.
  • If you currently have the Smart Card Reader feature (FC 0885) and Additional Smart Card feature (FC 0884), they can only be carried forward to TKE 10.0 as follows:
    • The smart card readers can be used on TKE 10.0 without any restrictions.
    • If you have initialized any smart cards as CA, TKE, IBM Enterprise PKCS#11 (EP11), or MCA smart cards, you can use them on your TKE 10.0 system without any restrictions.
    • If you have initialized any smart cards as IA or KPH smart cards, you cannot use them for migration tasks done with Crypto Express7S or Crypto Express8S modules.
    • A smart card from FC 0885 or 0886 can be initialized as any one of the 6 types (CA, TKE, EP11, MCA, IA or KPH) of smart cards on TKE 10.0.
To use the TKE function on 9176, the following must be installed:
  • FC 0908 or FC 0909: Crypto Express8S
  • FC 0898 or FC 0899: Crypto Express7S
  • FC 0882: TKE 10.0 LIC (Licensed Internal Code)
  • FC 3863: CP Assist for Cryptographic Function

Power requirements

  • The TKE workstation (Tabletop) requires a single-phase feed from one customer-supplied outlet that provides one of the following voltage ranges:
    • 100 V AC - 127 V AC (nominal range)
    • 200 V AC - 240 V AC (nominal range)
  • The TKE workstation (Rack Mount) requires a single-phase feed from two customer-supplied outlets that provide one of the following voltage ranges:
    • 100 V AC - 127 V AC (nominal range)
    • 200 V AC - 240 V AC (nominal range)
  • The TKE KMM (Tabletop or Rack Mount) requires a single-phase feed from one customer-supplied outlet that provides the following voltage range:
    • 100 V AC - 240 V AC (nominal range)