12 ITEMS

This document describes how to integrate Microsoft SQL Server with the nShield Database Security Option Pack (nDSOP V2.1) using an Entrust nShield hardware security module (HSM) as a Root of Trust for storage encryption.

Entrust Hardware Security Modules (HSMs) integrate with Microsoft Authenticode to enable you to identify the publisher of a software component before it is downloaded from the Internet, and to verify that no one has altered the code after it has been signed.

This guide describes the integration of Microsoft Internet Information Services (IIS) for Windows Server with Entrust nShield® hardware security modules (HSMs). The integration of the nShield HSMs with IIS provides full key life-cycle management with FIPS-certified hardware and reduces the cryptographic load on the host server CPU.

This guide provides instructions for integrating an nShield HSM with Microsoft Active Directory Certificate Services (AD CS), Online Certificate Status Protocol (OCSP), and Microsoft Windows Server 2019 and Microsoft Windows Server 2016 (Standard, Datacenter, and Server Core editions).

Active Directory Federation Services (AD FS) is an installable component of the Microsoft Windows operating System. Once configured it provides the facility for single sign on for credential sharing and access control between trusted business partners (known as a federation) and across multiple business boundaries via a claims based authorization process using standards-based protocols such as https.

This document describes how to integrate the Microsoft Network Device Enrollment Service (NDES) with the Entrust nShield hardware security module (HSM) as a Root of Trust for storage encryption, to protect the private keys and meet FIPS 140-2 Level 2 or Level 3.

You can integrate Microsoft 365 with a Entrust Time Stamp Option Pack to permit theuse of time stamping to seal documents. The Entrust Time Stamp Option Pack is referred to in this guide as Time Stamp Server (TSS).

This guide covers integration of the Host Guardian Service (HGS) role included in Microsoft Windows Server 2019 with the Entrust range of Hardware Security Modules (HSMs). The HGS can only be configured on Windows Server 2019 Standard or Datacenter; the HGS role is not supported on Nano Server or other versions of the Windows operating system.

This Integration Guide is part of the Bring Your Own Key (BYOK) Deployment Service Package for Microsoft Azure and covers the creation and transfer of a cryptographic key for use with Azure Key Vault. This cryptographic key, known as a tenant key if used with Azure Rights Management Service and Azure Information Protection, is created within the protection of the nShield Security World on the customer's premises and then securely transferred to Microsoft Azure and the protection of an nShield Security World hosted within Azure via Key Vault.

This document describes the integration of Microsoft Azure Key Vault Bring Your Own Key (referred to as Azure BYOK in this guide) with the Entrust KeyControl Key Management Solution (KMS).