All geek questions in one place

HSM - cryptocurrencies - sessions - timeout

My application accesses HSM through the ASP.NET web service through PKCS # 11. I initialize the crypto library and get the session descriptor. The web service supports this descriptor to perform encryption / decryption / signature / verification in batch mode.

The problem I am facing is ASP.NET Web Service Timeouts after 20 minutes. This act, I think, unloads the cryptocurrency library, and the session handle stored in the web service becomes invalid. Yes, I agree that the ASP.NET web service can not be reconfigured to a timeout that will constantly load the cryptocurrency library.

My question is: what happens to the session descriptor that I received primarily from HSM ?. Will it be lost or will it be unused there? I ask about this because I am not closing the open session properly by calling c_closeSession.

Web service is implemented through a thread pool.

thank

+1
source share
2 answers

You should call C_Finalize()when you are done using the cryptocurrency library. A well-written implementation can be reliable if you do not, but there are no guarantees. Your open sessions can be supported in HSM and possibly in the driver.

Be sure to think about calling C_Finalize()from Application_End().

+1

PKCS # 11 spec, , 6.6

cryptoki C_Initialize. - PKCS # 11, HSM, . , , , ( ).

? , (), , , .

+1

Source: https://habr.com/ru/post/1754217/

More articles:


All Articles