public interface HSMDevice extends Device
The hardware safe module object is obtained from the POSTerminal
, its' as follows:
HSMDevice hsmDevice = (HSMDevice) POSTerminal.getInstance().getDevice("cloudpos.device.hsm");Among them, the "cloudpos.device.hsm" string is to identify the hardware safe module, defined by the specific implementation.
The HSM device is not exclusive device. It can be opened by several applications simultaneously. But some write operation must be exclusive.
Uses the hardware safe module device object to control the operation of the hardware safe module.
An app can request permission to access the device, as shown below:
<uses-permission android:name="android.permission.CLOUDPOS_SAFE_MODULE" />
Device
Modifier and Type | Field and Description |
---|---|
static int |
CERT_FORMAT_DER
DER format
|
static int |
CERT_FORMAT_PEM
PEM format
|
static int |
CERT_TYPE_APP_ROOT
Terminal application root certificate
|
static int |
CERT_TYPE_COMM_ROOT
Terminal SSL communication root certificate
|
static int |
CERT_TYPE_PUBLIC_KEY
Terminal public key certificate
|
static int |
CERT_TYPE_TERMINAL_OWNER
Terminal owner root certificate
|
Modifier and Type | Method and Description |
---|---|
byte[] |
decrypt(int algorithm,
java.lang.String aliasPrivateKey,
byte[] bufCipher)
Do decryption by the given private key.
|
boolean |
deleteCertificate(int certType,
java.lang.String alias)
Removes the certificate of the given alias.
|
boolean |
deleteKeyPair(java.lang.String aliasPrivateKey)
Removes the key pair of the given alias.
|
byte[] |
encrypt(int algorithm,
java.lang.String aliasPrivateKey,
byte[] bufPlain)
Do encryption by the given private key.
|
byte[] |
generateCSR(java.lang.String aliasPrivateKey,
javax.security.auth.x500.X500Principal subject)
Generates the CSR for given private key.
|
void |
generateKeyPair(java.lang.String aliasPrivateKey,
int algorithm,
int keySize)
Requests hardware safe module to generate a key pair inside the module.
|
byte[] |
generateRandom(int length)
Gets the real random buffer from hardware safe module.
|
byte[] |
getCertificate(int certType,
java.lang.String alias,
int dataFormat)
Gets the certificate data.
|
java.lang.String |
getEncryptedUniqueCode(java.lang.String uniqueCode,
java.lang.String randomFactor)
Gets the encrypted cipher data of unique code.
|
long |
getFreeSpace()
Gets the free space of the hardware safe module.
|
boolean |
injectPublicKeyCertificate(java.lang.String alias,
java.lang.String aliasPrivateKey,
byte[] bufCert,
int dataFormat)
Injects the certificate of the public key of the existing key pair.
|
boolean |
injectRootCertificate(int certType,
java.lang.String alias,
byte[] bufCert,
int dataFormat)
Injects the root certificates to hardware safe module.
|
boolean |
isTampered()
Checks the hardware safe module is tampered or not.
|
void |
open(int logicalID)
Opens the hardware safe module for use.
|
java.lang.String[] |
queryCertificates(int certType)
Gets the certificates from the hardware safe module.
|
cancelRequest, close, getFailCount, getUsageCount, open
static final int CERT_FORMAT_PEM
static final int CERT_FORMAT_DER
static final int CERT_TYPE_TERMINAL_OWNER
static final int CERT_TYPE_PUBLIC_KEY
static final int CERT_TYPE_APP_ROOT
static final int CERT_TYPE_COMM_ROOT
void open(int logicalID) throws DeviceException
logicalID
- The logical ID of the hardware safe module device to open.DeviceException
- for the standard reasons that are documented in DeviceException
.boolean isTampered() throws DeviceException
The operation is not exclusive. Hardware safe module with automatic protection mechanism, in the event of the attack on hardware safe module, automatically trigger self-destruction and remove all sensitive information
true
tempered. false
not tempered.DeviceException
- for the standard reasons that are documented in DeviceException
.byte[] generateRandom(int length) throws DeviceException
The operation is not exclusive.
length
- The length of the buffer< 64.DeviceException
- for the standard reasons that are documented in DeviceException
.void generateKeyPair(java.lang.String aliasPrivateKey, int algorithm, int keySize) throws DeviceException
aliasPrivateKey
- The alias of the private key.algorithm
- The algorithm of the key pair. Currently, only "RSA" is supported.keySize
- The bit size of the key. Currently, only 2048 is supported.DeviceException
- for the standard reasons that are documented in DeviceException
.boolean injectPublicKeyCertificate(java.lang.String alias, java.lang.String aliasPrivateKey, byte[] bufCert, int dataFormat) throws DeviceException
The operation is exclusive.
alias
- The alias of the certificate.aliasPrivateKey
- The alias of the key pair, usually it's the private key's alias.bufCert
- The data of the certificate.dataFormat
- The format of the buffer, Currently, only CERT_FORMAT_PEM
is supported.true
Success.false
FailDeviceException
- for the standard reasons that are documented in DeviceException
.boolean injectRootCertificate(int certType, java.lang.String alias, byte[] bufCert, int dataFormat) throws DeviceException
All the certificate must signed by the terminal's owner certificate. The keyUsage flag must be set as define:
CERT_TYPE_TERMINAL_OWNER
certificate's keyUsage flag must be set as critical, and the KeyEncipherment, CertificateSign and CRLSign must be set, other flags are cleared.
CERT_TYPE_APP_ROOT
certificate's keyUsage flag must be set as critical, and the DigitalSignature, CertificateSign must be set, other flags are cleared.
CERT_TYPE_COMM_ROOT
certificate's keyUsage flag must be set as non-critical and DigitalSignature, KeyEncipherment, DataEncipherment must be set, other flags are cleared.
certType
- The certificate type: CERT_TYPE_TERMINAL_OWNER
, CERT_TYPE_APP_ROOT
or CERT_TYPE_COMM_ROOT
.alias
- The alias of the certificate.bufCert
- The data of the certificate.dataFormat
- The format of the buffer, Currently, only CERT_FORMAT_PEM
is supported.true
Success. false
Fail.DeviceException
- for the standard reasons that are documented in DeviceException
.byte[] getCertificate(int certType, java.lang.String alias, int dataFormat) throws DeviceException
The operation is not exclusive.
certType
- The certificate type, could be CERT_TYPE_TERMINAL_OWNER
, CERT_TYPE_APP_ROOT
or CERT_TYPE_COMM_ROOT
.alias
- The alias of the certificate.dataFormat
- The format of the buffer, Currently, only CERT_FORMAT_PEM
is supported.DeviceException
- for the standard reasons that are documented in DeviceException
.boolean deleteCertificate(int certType, java.lang.String alias) throws DeviceException
The OWNER certificate can't be removed.
The operation is exclusive.
certType
- The certificate type, could be CERT_TYPE_PUBLIC_KEY
, CERT_TYPE_APP_ROOT
or CERT_TYPE_COMM_ROOT
.alias
- The alias of the certificate.true
Delete success. false
Delete fail.DeviceException
- for the standard reasons that are documented in DeviceException
.java.lang.String[] queryCertificates(int certType) throws DeviceException
certType
- The certificate type.DeviceException
- for the standard reasons that are documented in DeviceException
.boolean deleteKeyPair(java.lang.String aliasPrivateKey) throws DeviceException
aliasPrivateKey
- The alias of the private key.true
Success. false
Fail.DeviceException
- for the standard reasons that are documented in DeviceException
.byte[] generateCSR(java.lang.String aliasPrivateKey, javax.security.auth.x500.X500Principal subject) throws DeviceException
aliasPrivateKey
- The alias of the private key.subject
- X500Principal.DeviceException
- for the standard reasons that are documented in DeviceException
.byte[] encrypt(int algorithm, java.lang.String aliasPrivateKey, byte[] bufPlain) throws DeviceException
algorithm
- the algorithm of encrypt.aliasPrivateKey
- the alias of the given private key.bufPlain
- the buffer of the plain data.DeviceException
- for the standard reasons that are documented in DeviceException
.byte[] decrypt(int algorithm, java.lang.String aliasPrivateKey, byte[] bufCipher) throws DeviceException
algorithm
- The algorithm of decrypt.aliasPrivateKey
- The alias of the given private key.bufCipher
- The buffer of the cipher data.DeviceException
- for the standard reasons that are documented in DeviceException
.long getFreeSpace() throws DeviceException
DeviceException
- for the standard reasons that are documented in DeviceException
.java.lang.String getEncryptedUniqueCode(java.lang.String uniqueCode, java.lang.String randomFactor) throws DeviceException
uniqueCode
- randomFactor
- DeviceException