Strongkey’s StrongAuth KeyAppliance (SAKA) is designed to be installed as a cluster with N appliances (nodes)in the cluster. A Development environment may have only a single node, while a Production environment must have a minimum of two (2) nodes. This is necessary to provide High Availability (HA) for cryptographic services to applications, and to ensure business continuity in the event of a disaster. A cluster may have more than two appliances, but two is the minimum. (If there are more than two nodes in the cluster, the third, fourth, etc. node follow the same steps as the second node).

As a result, SAKA installation follows a process where the tasks are alternated between two appliances. This chapter describes these tasks. The appliance expected to be installed first is known as the Primary SAKA, while appliances installed after the first SAKA instance are designated as Secondary SAKA in this documentation.

NOTE: Notwithstanding the designation of Primary and Secondary nodes within a SAKA 4.0 cluster, all nodes in the cluster are equal: they can receive and respond to web service requests simultaneously while replicating to each other asynchronously. While the replication latency depends on the network bandwidth between nodes of the cluster, the level of traffic on the network, and the number of transactions being processed at any given time, replication latency between nodes is generally in the order of seconds or minutes. If a node disappears from the cluster for any reason, all other nodes hold transactions for the missing node until it returns; when it does, synchronization is automatic.

When SAKA servers are delivered, the Linux operating system has already been installed with the necessary packages to operate the appliance. The operating system is partially configured; some parameters can only be configured upon connecting them to a network.

The uninstalled software components used by the SAKA application are delivered in the /usr/local/software/saka directory of each appliance.

At a high level, after choosing site-specific parameters in the forms shown in this chapter, the sequence of installation steps involves:

1. Installing the Primary with required software components—but not initializing the cryptographic module.

2. Installing the Secondary with required software components—but not initializing the cryptographic module.

3. Initializing the cryptographic module on the Primary.

4. Initializing the cryptographic module on the Secondary.

5. Creating a new encryption domain on the Primary, preparing the master key of the new domain for migration and testing the cryptographic web services on this appliance.

6. Completing the migration of the new encryption domain's master key on the Secondary and testing the cryptographic web services on this appliance.

7. Starting the appliance's administration console, adding service credentials for applications, configuring site-specific parameters, and running some tests.

8. Verifying two-way replication on the appliances.

Each SAKA ships with five (5) colored USB flash memory drives. The colored USB drives are intended to be used as described here:

NOTE: While the Production environment only needs four (4) USB flash drive tokens—Red, Green, Blue and Yellow—on a regular basis, it is recommended that the remaining flash drive tokens are used as secure backups of the primary tokens, in the event any of the primary tokens are lost/damaged. Without the tokens, the cryptographic hardware module cannot be activated; without the cryptographic hardware module, it is impossible to decrypt any cryptographic key in the appliance.