Hardware Specifications

Available Models

• k470 - no HSM, 4x1Gbit ports

• k470 - no HSM, 2x1Gbit ports and 2x10Gbit ports

• k570 - HSM, 4x1Gbit ports

• k570 - HSM, 2x1Gbit ports and 2x10Gbit ports

• k160 - HSM

Specifications for k470 and k570

The base chassis for k470 and k570 are the same, and so the specifications are presented together. However, the k570 includes a PCIe HSM and the k470 does not.

The CipherTrust Manager k470 and k570 Appliances are 1U high and fit into standard 19-inch equipment racks.

Hardware Specifications for k470 and k570

Firmware Specifications for k470 and k570

Front Panel for k470 and k570

The front panel is illustrated below, with the secure locking bezel removed:

Rear Panel for k470 and k570

The rear panel is illustrated below:

Network Interface for 1Gbps k470 and k570 Models

1Gbps models come with four 1 Gbit RJ45 Ethernet network ports (labeled 0, 1, 2, and 3). The network interfaces are mapped to Ethn, as detailed in the following illustration.

All ports are identical and equally usable and can be bonded in any combination. By default port Eth0 is configured for DHCP but this can be configured.

Refer to Network Configuration Tutorial for more information.

Network Interface Mapping for 1Gbps/10Gbps k470 and k570 Models

10 Gbps models provide two 10Gbps SFP optical Ethernet network ports (labeled 0 and 1) and two 1Gbps copper RJ45 network ports (labeled 2 and 3). The network interfaces are mapped to Ethn, as detailed in the following illustration.

You can optionally bond the network interfaces Eth0 with Eth1 or Eth2 with Eth3 to form a logical interface, providing a redundant active/standby virtual interface. By default port Eth0 is configured for DHCP but this can be configured.

Refer to Network Configuration Tutorial for more information.

Front Panel LCD for k470 and k570 Models

The Front Panel displays the product name (CipherTrust), the firmware version, and the IP address of any configured network interface.

HSM Emergency Decommission Button for k570 models

The CipherTrust Manager k570 Appliance includes a way to decommission the HSM, or permanently deny access to all objects on it, without need for either a serial console or a remote (SSH) connection.

To directly decommission the HSM inside the appliance, press and release the small red button on the rear panel.

• The appliance does not need to be powered on.

• The appliance does not need to have power cables connected.

You will need a small screw-driver or other tool to reach the Emergency Decommission button. This is intentional, to prevent accidental pressing of that button.

What the Emergency Decommission Button Does

When you press the Decommission button, all partitions and their contents are deleted, as well as the audit role, and the audit configuration. The HSM policy settings are retained.

For k570 models, pressing the Decommission button makes all data and keys created on the CipherTrust Manager become permanently unusable, including keys in backups associated to the HSM.

To bring the HSM back into service, you need to:

1. Reinitialize the HSM.

2. Reinitialize the audit role and reconfigure auditing.

3. Recreate the partitions.

4. Reinitialize the partition roles.

5. Reset the system kscfg system reset.

6. Setup the HSM as described in Hardware Security Module.

At this point, you can recreate encryption keys on CipherTrust Manager.

Power Consumption for k470 and k570 Models

When installed and connected to appropriate electrical power sources, CipherTrust Manager k470 or k570 Appliance draws power as follows:

The appliance has two power supplies, each rated at 350W, either of which is capable of running the system alone.

Hardware Specifications for k160 Model

The TCT CipherTrust Manager k160 Appliance is a compact cryptographic key management platform that protects and manages cryptographic keys and associated policies used to encrypt the most sensitive data-at-rest. This cost-effective solution is ideal for small to medium sized deployments commonly found in small offices, remote sites, and tactical environments. The k160 includes a FIPS 140-2 Level 3 token or a high assurance cryptographic token as its hardware root of trust. The token hardware security module (HSM) operates as a secure root of trust by encrypting all sensitive objects (e.g. keys, certificates, etc.) in CipherTrust Manager, with keys that are generated by, and reside in, the token HSM. The removable token HSM provides and easy to use method to support common key management scenarios such as rapid key delivery disablement, key destruction, cryptographic erase, and time of use restrictions. Simply removing the token allows for keeping mission critical data safe.

k160 Technical Specifications

Physical Characteristics

• CipherTrust k160 Dimensions: 6.5” x 4.0” x 1.5”

• Weight: 1.2 lbs.

• Direct mount or 1U 19in. rack mount (optional accessory)

• Thermal Storage: -30°C ~ 80°C

• Thermal Operation: -30 ~ 65°C

• Storage Humidity: 5 ~ 95% @ 40C

• Operating Humidity: 0% ~ 90% relative humidity

• Vibration Testing: Random, 1Grm, 5~500Hz

• Power: included external power supply; locking DC power connector

• Power Range: input 120-240V AC, 1.5A, 50-60Hz; output 12V DC, 40W

Interfaces

• Web UI Management

• Serial and SSH command line

• KMIP, NAE-XML, and REST API

• 1G Ethernet interface

• Integrated Token HSM connection

k160 Front Panel

The front panel is illustrated below, showing the High Assurance token inserted:

k160 Rear Panel

The rear panel is illustrated below: